@quantakrypto/core 0.4.4 → 0.6.0

package/dist/detectors/messaging.js.map

@@ -1 +1 @@
-{"version":3,"file":"messaging.js","sourceRoot":"","sources":["../../src/detectors/messaging.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAC9E,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAEnE,MAAM,aAAa,GAAsB,CAAC,aAAa,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;AAOlF,MAAM,QAAQ,GAAa;IACzB;QACE,2EAA2E;QAC3E,sEAAsE;QACtE,EAAE,EAAE,wEAAwE;QAC5E,IAAI,EAAE;YACJ,EAAE,EAAE,qBAAqB;YACzB,KAAK,EAAE,2BAA2B;YAClC,WAAW,EAAE,kEAAkE;YAC/E,QAAQ,EAAE,KAAK;YACf,QAAQ,EAAE,QAAQ;YAClB,UAAU,EAAE,MAAM;YAClB,IAAI,EAAE,KAAK;YACX,GAAG,EAAE,mBAAmB;YACxB,OAAO,EACL,8FAA8F;YAChG,WAAW,EAAE,4DAA4D;SAC1E;KACF;IACD;QACE,EAAE,EAAE,0CAA0C;QAC9C,IAAI,EAAE;YACJ,EAAE,EAAE,oBAAoB;YACxB,KAAK,EAAE,yBAAyB;YAChC,WAAW,EAAE,kDAAkD;YAC/D,QAAQ,EAAE,KAAK;YACf,QAAQ,EAAE,QAAQ;YAClB,UAAU,EAAE,MAAM;YAClB,IAAI,EAAE,KAAK;YACX,GAAG,EAAE,mBAAmB;YACxB,OAAO,EACL,6FAA6F;YAC/F,WAAW,EAAE,6DAA6D;SAC3E;KACF;IACD;QACE,EAAE,EAAE,+EAA+E;QACnF,IAAI,EAAE;YACJ,EAAE,EAAE,qBAAqB;YACzB,KAAK,EAAE,uCAAuC;YAC9C,WAAW,EAAE,+DAA+D;YAC5E,QAAQ,EAAE,KAAK;YACf,QAAQ,EAAE,QAAQ;YAClB,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,MAAM;YACjB,IAAI,EAAE,IAAI;YACV,GAAG,EAAE,iBAAiB;YACtB,OAAO,EACL,sHAAsH;YACxH,WAAW,EACT,+FAA+F;SAClG;KACF;CACF,CAAC;AAEF,kFAAkF;AAClF,MAAM,CAAC,MAAM,iBAAiB,GAAa;IACzC,EAAE,EAAE,qBAAqB;IACzB,WAAW,EAAE,6EAA6E;IAC1F,KAAK,EAAE,QAAQ;IACf,QAAQ,EAAE,KAAK;IACf,KAAK,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAClC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,aAAa,CAAC;IAChD,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE;QACtB,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;YAC5B,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;gBAChC,QAAQ,CAAC,IAAI,CACX,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CACxF,CAAC;YACJ,CAAC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC","sourcesContent":["/**\n * Config detector: classical transport crypto in message brokers / event streams\n * (Kafka, RabbitMQ, MQTT/Mosquitto, NATS). Broker traffic is \"communication\n * between things\"; a legacy TLS floor or a classical (EC)DHE cipher suite makes\n * every message in flight harvest-now-decrypt-later exposed.\n *\n * Covered in broker config files (`.properties`, `.conf`, `.cfg`, `.ini`):\n *  - Kafka `ssl.protocol` / `ssl.enabled.protocols = TLSv1 | TLSv1.1` (legacy).\n *  - MQTT/Mosquitto `tls_version tlsv1 | tlsv1.1` (legacy).\n *  - Kafka `ssl.cipher.suites` naming a classical `ECDHE_RSA` / `ECDHE_ECDSA` /\n *    `TLS_RSA` suite — the harvestable key-exchange path.\n */\nimport type { Detector, Finding, RuleMeta } from \"../types.js\";\nimport { eachMatch, findingFromRule, hasExtension } from \"../detect-utils.js\";\nimport { CWE_RISKY_PRIMITIVE, CWE_BROKEN_CRYPTO } from \"../cwe.js\";\n\nconst MQ_EXTENSIONS: readonly string[] = [\".properties\", \".conf\", \".cfg\", \".ini\"];\n\ninterface MqRule {\n  re: RegExp;\n  meta: RuleMeta;\n}\n\nconst MQ_RULES: MqRule[] = [\n  {\n    // Match TLSv1 (=1.0) and TLSv1.1 but never TLSv1.2 / TLSv1.3: the negative\n    // lookahead stops \"TLSv1\" from matching the \"TLSv1\" inside \"TLSv1.3\".\n    re: /\\bssl\\.(?:enabled\\.)?protocols?\\s*=\\s*[^\\n]*\\bTLSv1(?:\\.1)?(?![.\\d])/gi,\n    meta: {\n      id: \"mq-kafka-legacy-tls\",\n      title: \"Kafka legacy TLS protocol\",\n      description: \"Kafka ssl.protocol / ssl.enabled.protocols permits TLS 1.0 / 1.1\",\n      category: \"tls\",\n      severity: \"medium\",\n      confidence: \"high\",\n      hndl: false,\n      cwe: CWE_RISKY_PRIMITIVE,\n      message:\n        \"Kafka broker permits legacy TLS 1.0/1.1; its classical key exchange is weak and harvestable.\",\n      remediation: \"Require TLS 1.3 and track PQC-hybrid KEX (X25519MLKEM768).\",\n    },\n  },\n  {\n    re: /\\btls_version\\s+tlsv1(?:\\.1)?(?![.\\d])/gi,\n    meta: {\n      id: \"mq-mqtt-legacy-tls\",\n      title: \"MQTT legacy TLS version\",\n      description: \"Mosquitto/MQTT tls_version permits TLS 1.0 / 1.1\",\n      category: \"tls\",\n      severity: \"medium\",\n      confidence: \"high\",\n      hndl: false,\n      cwe: CWE_RISKY_PRIMITIVE,\n      message:\n        \"MQTT broker permits legacy TLS 1.0/1.1; its classical key exchange is weak and harvestable.\",\n      remediation: \"Require TLS 1.3 and track PQC-hybrid KEX for device fleets.\",\n    },\n  },\n  {\n    re: /\\bssl\\.cipher\\.suites\\s*=\\s*[^\\n]*(?:ECDHE_RSA|ECDHE_ECDSA|TLS_RSA|_DHE_RSA)/g,\n    meta: {\n      id: \"mq-classical-cipher\",\n      title: \"Broker classical (EC)DHE cipher suite\",\n      description: \"Kafka ssl.cipher.suites names a classical ECDHE/DHE/RSA suite\",\n      category: \"tls\",\n      severity: \"medium\",\n      confidence: \"high\",\n      algorithm: \"ECDH\",\n      hndl: true,\n      cwe: CWE_BROKEN_CRYPTO,\n      message:\n        \"Broker TLS is pinned to a classical (EC)DHE/RSA cipher suite; the key exchange is harvest-now-decrypt-later exposed.\",\n      remediation:\n        \"Move to TLS 1.3 with a PQC-hybrid group (X25519MLKEM768) once the broker/runtime supports it.\",\n    },\n  },\n];\n\n/** Detects classical transport crypto in message-broker / event-stream config. */\nexport const messagingDetector: Detector = {\n  id: \"messaging-transport\",\n  description: \"Classical transport crypto in message brokers (Kafka, MQTT, RabbitMQ, NATS)\",\n  scope: \"config\",\n  language: \"any\",\n  rules: MQ_RULES.map((r) => r.meta),\n  appliesTo: (f) => hasExtension(f, MQ_EXTENSIONS),\n  detect({ file, content }): Finding[] {\n    const findings: Finding[] = [];\n    for (const rule of MQ_RULES) {\n      eachMatch(rule.re, content, (m) => {\n        findings.push(\n          findingFromRule(rule.meta, { file, content, index: m.index, matchLength: m[0].length }),\n        );\n      });\n    }\n    return findings;\n  },\n};\n"]}
+{"version":3,"file":"messaging.js","sourceRoot":"","sources":["../../src/detectors/messaging.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAChG,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAEnE,MAAM,aAAa,GAAsB,CAAC,aAAa,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;AAOlF,MAAM,QAAQ,GAAa;IACzB;QACE,2EAA2E;QAC3E,sEAAsE;QACtE,EAAE,EAAE,8EAA8E;QAClF,IAAI,EAAE;YACJ,EAAE,EAAE,qBAAqB;YACzB,KAAK,EAAE,2BAA2B;YAClC,WAAW,EAAE,kEAAkE;YAC/E,QAAQ,EAAE,KAAK;YACf,QAAQ,EAAE,QAAQ;YAClB,UAAU,EAAE,MAAM;YAClB,IAAI,EAAE,KAAK;YACX,GAAG,EAAE,mBAAmB;YACxB,OAAO,EACL,0KAA0K;YAC5K,WAAW,EAAE,4DAA4D;SAC1E;KACF;IACD;QACE,EAAE,EAAE,0CAA0C;QAC9C,IAAI,EAAE;YACJ,EAAE,EAAE,oBAAoB;YACxB,KAAK,EAAE,yBAAyB;YAChC,WAAW,EAAE,kDAAkD;YAC/D,QAAQ,EAAE,KAAK;YACf,QAAQ,EAAE,QAAQ;YAClB,UAAU,EAAE,MAAM;YAClB,IAAI,EAAE,KAAK;YACX,GAAG,EAAE,mBAAmB;YACxB,OAAO,EACL,gJAAgJ;YAClJ,WAAW,EAAE,6DAA6D;SAC3E;KACF;IACD;QACE,gFAAgF;QAChF,kFAAkF;QAClF,qFAAqF;QACrF,EAAE,EAAE,2DAA2D;QAC/D,IAAI,EAAE;YACJ,EAAE,EAAE,sBAAsB;YAC1B,KAAK,EAAE,wCAAwC;YAC/C,WAAW,EACT,iFAAiF;YACnF,QAAQ,EAAE,KAAK;YACf,SAAS,EAAE,KAAK;YAChB,QAAQ,EAAE,QAAQ;YAClB,UAAU,EAAE,MAAM;YAClB,IAAI,EAAE,IAAI;YACV,GAAG,EAAE,iBAAiB;YACtB,OAAO,EACL,0KAA0K;YAC5K,WAAW,EACT,+FAA+F;SAClG;KACF;CACF,CAAC;AAEF,kFAAkF;AAClF,MAAM,CAAC,MAAM,iBAAiB,GAAa;IACzC,EAAE,EAAE,qBAAqB;IACzB,WAAW,EAAE,6EAA6E;IAC1F,KAAK,EAAE,QAAQ;IACf,QAAQ,EAAE,KAAK;IACf,KAAK,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAClC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,aAAa,CAAC;IAChD,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE;QACtB,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,2EAA2E;QAC3E,iFAAiF;QACjF,gEAAgE;QAChE,MAAM,IAAI,GAAG,gBAAgB,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;QACxD,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;YAC5B,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE;gBAC7B,QAAQ,CAAC,IAAI,CACX,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CACxF,CAAC;YACJ,CAAC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC","sourcesContent":["/**\n * Config detector: classical transport crypto in message brokers / event streams\n * (Kafka, RabbitMQ, MQTT/Mosquitto, NATS). Broker traffic is \"communication\n * between things\"; a legacy TLS floor or a classical (EC)DHE cipher suite makes\n * every message in flight harvest-now-decrypt-later exposed.\n *\n * Covered in broker config files (`.properties`, `.conf`, `.cfg`, `.ini`):\n *  - Kafka `ssl.protocol` / `ssl.enabled.protocols = TLSv1 | TLSv1.1` (legacy).\n *  - MQTT/Mosquitto `tls_version tlsv1 | tlsv1.1` (legacy).\n *  - Kafka `ssl.cipher.suites` naming a static-RSA `TLS_RSA_WITH_*` key-transport\n *    suite (the ECDHE/DHE suites are owned by source.ts's `tls-classical-kex`).\n */\nimport type { Detector, Finding, RuleMeta } from \"../types.js\";\nimport { eachMatch, findingFromRule, hasExtension, maskCommentLines } from \"../detect-utils.js\";\nimport { CWE_RISKY_PRIMITIVE, CWE_BROKEN_CRYPTO } from \"../cwe.js\";\n\nconst MQ_EXTENSIONS: readonly string[] = [\".properties\", \".conf\", \".cfg\", \".ini\"];\n\ninterface MqRule {\n  re: RegExp;\n  meta: RuleMeta;\n}\n\nconst MQ_RULES: MqRule[] = [\n  {\n    // Match TLSv1 (=1.0) and TLSv1.1 but never TLSv1.2 / TLSv1.3: the negative\n    // lookahead stops \"TLSv1\" from matching the \"TLSv1\" inside \"TLSv1.3\".\n    re: /\\bssl\\.(?:enabled\\.)?protocols?\\s*=\\s*[^\\n]{0,80}?\\bTLSv1(?:\\.1)?(?![.\\d])/gi,\n    meta: {\n      id: \"mq-kafka-legacy-tls\",\n      title: \"Kafka legacy TLS protocol\",\n      description: \"Kafka ssl.protocol / ssl.enabled.protocols permits TLS 1.0 / 1.1\",\n      category: \"tls\",\n      severity: \"medium\",\n      confidence: \"high\",\n      hndl: false,\n      cwe: CWE_RISKY_PRIMITIVE,\n      message:\n        \"Kafka broker permits legacy TLS 1.0/1.1, an obsolete protocol; require TLS 1.3 (the harvestable classical key exchange is reported separately by the cipher-suite rule).\",\n      remediation: \"Require TLS 1.3 and track PQC-hybrid KEX (X25519MLKEM768).\",\n    },\n  },\n  {\n    re: /\\btls_version\\s+tlsv1(?:\\.1)?(?![.\\d])/gi,\n    meta: {\n      id: \"mq-mqtt-legacy-tls\",\n      title: \"MQTT legacy TLS version\",\n      description: \"Mosquitto/MQTT tls_version permits TLS 1.0 / 1.1\",\n      category: \"tls\",\n      severity: \"medium\",\n      confidence: \"high\",\n      hndl: false,\n      cwe: CWE_RISKY_PRIMITIVE,\n      message:\n        \"MQTT broker permits legacy TLS 1.0/1.1, an obsolete protocol; require TLS 1.3 (the harvestable classical key exchange is reported separately).\",\n      remediation: \"Require TLS 1.3 and track PQC-hybrid KEX for device fleets.\",\n    },\n  },\n  {\n    // Only static-RSA key transport (`TLS_RSA_WITH_…`) is flagged here: the ECDHE /\n    // DHE suites are owned by source.ts's language-agnostic `tls-classical-kex` token\n    // rule (which fires on `.properties` too), so flagging them here would double-count.\n    re: /\\bssl\\.cipher\\.suites\\s*=\\s*[^\\n]{0,200}?\\bTLS_RSA_WITH_/g,\n    meta: {\n      id: \"mq-rsa-key-transport\",\n      title: \"Broker static-RSA key transport cipher\",\n      description:\n        \"Kafka ssl.cipher.suites names a static-RSA (TLS_RSA_WITH_*) key-transport suite\",\n      category: \"kem\",\n      algorithm: \"RSA\",\n      severity: \"medium\",\n      confidence: \"high\",\n      hndl: true,\n      cwe: CWE_BROKEN_CRYPTO,\n      message:\n        \"Broker TLS is pinned to a static-RSA (TLS_RSA_WITH_*) key-transport suite; the wrapped session key is harvest-now-decrypt-later exposed (and it has no forward secrecy).\",\n      remediation:\n        \"Move to TLS 1.3 with a PQC-hybrid group (X25519MLKEM768) once the broker/runtime supports it.\",\n    },\n  },\n];\n\n/** Detects classical transport crypto in message-broker / event-stream config. */\nexport const messagingDetector: Detector = {\n  id: \"messaging-transport\",\n  description: \"Classical transport crypto in message brokers (Kafka, MQTT, RabbitMQ, NATS)\",\n  scope: \"config\",\n  language: \"any\",\n  rules: MQ_RULES.map((r) => r.meta),\n  appliesTo: (f) => hasExtension(f, MQ_EXTENSIONS),\n  detect({ file, content }): Finding[] {\n    const findings: Finding[] = [];\n    // Broker config files ship large commented-out example blocks; a commented\n    // directive is not active. Match over comment-masked content (offsets preserved,\n    // so the snippet from the original `content` is still correct).\n    const scan = maskCommentLines(content, [\"#\", \"!\", \";\"]);\n    for (const rule of MQ_RULES) {\n      eachMatch(rule.re, scan, (m) => {\n        findings.push(\n          findingFromRule(rule.meta, { file, content, index: m.index, matchLength: m[0].length }),\n        );\n      });\n    }\n    return findings;\n  },\n};\n"]}

package/dist/detectors/objc.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Source detector for classical asymmetric cryptography in Objective-C on Apple
+ * platforms (iOS / macOS / tvOS / watchOS), via the Security framework's
+ * `SecKey*` API (and, underneath it, CommonCrypto). This is the Objective-C
+ * sibling of the Swift pack: the same Security-framework surface, reached from
+ * `.m` / `.mm` translation units instead of `.swift`. Lexical, same strategy as
+ * the other language packs — the Security-framework identifiers
+ * (`kSecAttrKeyType*`, `kSecKeyAlgorithm*`) are distinctive enough to keep the
+ * false-positive risk low.
+ *
+ * WHY a dedicated Objective-C pack (and not the C/C++ pack):
+ *  - The C/C++ pack (`c.ts`) matches OpenSSL / libsodium / Mbed TLS / wolfSSL
+ *    symbols and is gated to `.c/.h/.cc/.cpp/...` (which INCLUDES `.h`). Apple's
+ *    Security framework is a different API surface entirely, so a separate pack
+ *    is the clean home for it.
+ *  - Objective-C headers are `.h` — shared with C/C++. To avoid double-scanning
+ *    a header the C pack already owns, this detector is gated to `.m` and `.mm`
+ *    ONLY (implementation files). Declarations of `SecKey*` usage live in the
+ *    implementation, not the interface, so no real coverage is lost.
+ *
+ * Security-framework surface mapped here:
+ *  - Key generation attributes (`SecKeyCreateRandomKey` / `SecKeyGeneratePair`):
+ *      `kSecAttrKeyTypeRSA`                         → RSA keygen (kem, hndl:true)
+ *      `kSecAttrKeyTypeEC` / `…ECSECPrimeRandom`    → EC keygen (ECDSA, signature,
+ *                                                     hndl:false — EC keys default
+ *                                                     to signing; conservative)
+ *  - Signing / verifying (`SecKeyCreateSignature` / `SecKeyVerifySignature`):
+ *      `kSecKeyAlgorithmRSASignature*`              → RSA signature (hndl:false)
+ *      `kSecKeyAlgorithmECDSASignature*`            → ECDSA signature (hndl:false)
+ *  - Encryption / key agreement (`SecKeyCreateEncryptedData` / `SecKeyCopyKeyExchangeResult`):
+ *      `kSecKeyAlgorithmRSAEncryption*`             → RSA encryption (kem, hndl:true)
+ *      `kSecKeyAlgorithmECDHKeyExchange*`           → ECDH key agreement (hndl:true)
+ *
+ * Comment suppression is handled inline here (Objective-C is a C-style comment
+ * language): C-style block comments and `//` line comments are masked before the
+ * regexes run, so commented-out crypto never fires.
+ */
+import type { Detector } from "../types.js";
+/** Detects classical asymmetric crypto in Objective-C (Apple Security framework). */
+export declare const objcDetector: Detector;
+//# sourceMappingURL=objc.d.ts.map

package/dist/detectors/objc.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"objc.d.ts","sourceRoot":"","sources":["../../src/detectors/objc.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAqB,MAAM,aAAa,CAAC;AAuH/D,qFAAqF;AACrF,eAAO,MAAM,YAAY,EAAE,QAmD1B,CAAC"}

package/dist/detectors/objc.js

@@ -0,0 +1,146 @@
+import { eachMatch, findingFromRule, hasExtension, maskBlockComments, maskCommentLines, OBJC_EXTENSIONS, } from "../detect-utils.js";
+import { CWE_BROKEN_CRYPTO } from "../cwe.js";
+// Security-framework key-type attributes (used with SecKeyCreateRandomKey /
+// SecKeyGeneratePair). RSA vs EC. The EC form covers both the modern
+// `kSecAttrKeyTypeECSECPrimeRandom` and the legacy `kSecAttrKeyTypeEC` alias.
+const RE_OBJC_SEC_RSA = /\bkSecAttrKeyTypeRSA\b/g;
+const RE_OBJC_SEC_EC = /\bkSecAttrKeyType(?:ECSECPrimeRandom|EC)\b/g;
+// SecKey algorithm constants for signing / encryption / key agreement. The `\w*`
+// tail captures the full family suffix (…PKCS1v15SHA256, …OAEPSHA256, …Standard,
+// …CofactorX963SHA256, …) without needing to enumerate every variant.
+const RE_OBJC_RSA_SIGN = /\bkSecKeyAlgorithmRSASignature\w*/g;
+const RE_OBJC_RSA_ENCRYPT = /\bkSecKeyAlgorithmRSAEncryption\w*/g;
+const RE_OBJC_ECDSA_SIGN = /\bkSecKeyAlgorithmECDSASignature\w*/g;
+const RE_OBJC_ECDH = /\bkSecKeyAlgorithmECDHKeyExchange\w*/g;
+const RULE_OBJC_SEC_RSA = {
+    id: "objc-seckey-rsa",
+    title: "Objective-C Security-framework RSA key",
+    description: "SecKeyCreateRandomKey / SecKeyGeneratePair with kSecAttrKeyTypeRSA",
+    category: "kem",
+    severity: "high",
+    confidence: "high",
+    algorithm: "RSA",
+    hndl: true,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "Security-framework RSA key (Objective-C) is classical and not quantum-safe.",
+    remediation: "Migrate to PQC as Apple's CryptoKit / Security add support: ML-KEM for encryption/key-agreement, ML-DSA for signatures.",
+};
+const RULE_OBJC_SEC_EC = {
+    id: "objc-seckey-ec",
+    title: "Objective-C Security-framework EC key",
+    description: "SecKeyCreateRandomKey / SecKeyGeneratePair with kSecAttrKeyTypeECSECPrimeRandom",
+    // An EC key at generation is AMBIGUOUS (it can feed ECDSA signing OR ECDH key
+    // agreement). The fleet convention (java-ec-keygen, python-ec-keygen, swift-sec-ec,
+    // cloud-kms-ec, …) classifies ambiguous EC keygen as key-exchange/ECDH/hndl:true —
+    // the HNDL-SAFE choice, so a possible key-agreement use is never under-reported.
+    category: "key-exchange",
+    severity: "high",
+    confidence: "high",
+    algorithm: "ECDH",
+    hndl: true,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "Security-framework EC key (Objective-C); EC keys feed ECDH key agreement (harvest-now-decrypt-later exposed) as well as ECDSA signatures, and are not quantum-safe.",
+    remediation: "Migrate to PQC as Apple's CryptoKit / Security add support: ML-KEM for the ECDH key-agreement path, ML-DSA for signatures.",
+};
+const RULE_OBJC_RSA_SIGN = {
+    id: "objc-rsa-sign",
+    title: "Objective-C RSA signature",
+    description: "SecKeyCreateSignature / SecKeyVerifySignature with kSecKeyAlgorithmRSASignature*",
+    category: "signature",
+    // `high`, consistent with every sibling pack's signature severity (swift-rsa,
+    // go-rsa-sign, java-rsa-sign) — the same primitive must not flip CI exit codes
+    // based on which language wrote it.
+    severity: "high",
+    confidence: "high",
+    algorithm: "RSA",
+    hndl: false,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "Classical RSA signing (Objective-C, Security framework) is forgeable by a quantum attacker.",
+    remediation: "Migrate to ML-DSA (FIPS 204) as Apple's CryptoKit / Security add PQC support.",
+};
+const RULE_OBJC_RSA_ENCRYPT = {
+    id: "objc-rsa-encrypt",
+    title: "Objective-C RSA encryption",
+    description: "SecKeyCreateEncryptedData with kSecKeyAlgorithmRSAEncryption*",
+    category: "kem",
+    severity: "high",
+    confidence: "high",
+    algorithm: "RSA",
+    hndl: true,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "Classical RSA encryption (Objective-C, Security framework) is harvest-now-decrypt-later exposed.",
+    remediation: "Migrate to ML-KEM (FIPS 203) as Apple's CryptoKit / Security add PQC support.",
+};
+const RULE_OBJC_ECDSA_SIGN = {
+    id: "objc-ecdsa-sign",
+    title: "Objective-C ECDSA signature",
+    description: "SecKeyCreateSignature / SecKeyVerifySignature with kSecKeyAlgorithmECDSASignature*",
+    category: "signature",
+    // `high`, consistent with swift-ecdsa / go-ecdsa / java-ecdsa-sign / dart-ecdsa.
+    severity: "high",
+    confidence: "high",
+    algorithm: "ECDSA",
+    hndl: false,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "Classical ECDSA signing (Objective-C, Security framework) is forgeable by a quantum attacker.",
+    remediation: "Migrate to ML-DSA (FIPS 204) as Apple's CryptoKit / Security add PQC support.",
+};
+const RULE_OBJC_ECDH = {
+    id: "objc-ecdh",
+    title: "Objective-C ECDH key agreement",
+    description: "SecKeyCopyKeyExchangeResult with kSecKeyAlgorithmECDHKeyExchange*",
+    category: "key-exchange",
+    severity: "high",
+    confidence: "high",
+    algorithm: "ECDH",
+    hndl: true,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "Elliptic-curve Diffie-Hellman (Objective-C, Security framework) is broken by Shor's algorithm (harvest-now-decrypt-later).",
+    remediation: "Migrate key agreement to ML-KEM (FIPS 203) as Apple's CryptoKit / Security add PQC support.",
+};
+/** Detects classical asymmetric crypto in Objective-C (Apple Security framework). */
+export const objcDetector = {
+    id: "objc-crypto",
+    description: "Classical asymmetric crypto in Objective-C (Apple Security framework / SecKey)",
+    scope: "source",
+    language: "objc",
+    rules: [
+        RULE_OBJC_SEC_RSA,
+        RULE_OBJC_SEC_EC,
+        RULE_OBJC_RSA_SIGN,
+        RULE_OBJC_RSA_ENCRYPT,
+        RULE_OBJC_ECDSA_SIGN,
+        RULE_OBJC_ECDH,
+    ],
+    appliesTo: (f) => hasExtension(f, OBJC_EXTENSIONS),
+    detect({ file, content }) {
+        // Fast reject: none of the Security-framework surface can appear without one
+        // of these substrings, so most Objective-C files bail before any regex runs.
+        if (!content.includes("SecKey") &&
+            !content.includes("kSecAttrKeyType") &&
+            !content.includes("kSecKeyAlgorithm")) {
+            return [];
+        }
+        // Mask C-style block comments then `//` line comments so commented-out crypto
+        // does not fire. Both maskers preserve byte offsets, so finding line/column
+        // stay exact.
+        const masked = maskCommentLines(maskBlockComments(content), ["//"]);
+        const findings = [];
+        // Scan the masked text, but build the finding (its snippet) from the ORIGINAL
+        // `content` so a line with a trailing comment renders live, not blanked.
+        const add = (re, rule) => eachMatch(re, masked, (m) => findings.push(findingFromRule(rule, {
+            file,
+            content,
+            index: m.index,
+            matchLength: m[0].length,
+        })));
+        add(RE_OBJC_SEC_RSA, RULE_OBJC_SEC_RSA);
+        add(RE_OBJC_SEC_EC, RULE_OBJC_SEC_EC);
+        add(RE_OBJC_RSA_SIGN, RULE_OBJC_RSA_SIGN);
+        add(RE_OBJC_RSA_ENCRYPT, RULE_OBJC_RSA_ENCRYPT);
+        add(RE_OBJC_ECDSA_SIGN, RULE_OBJC_ECDSA_SIGN);
+        add(RE_OBJC_ECDH, RULE_OBJC_ECDH);
+        return findings;
+    },
+};
+//# sourceMappingURL=objc.js.map

package/dist/detectors/objc.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"objc.js","sourceRoot":"","sources":["../../src/detectors/objc.ts"],"names":[],"mappings":"AAsCA,OAAO,EACL,SAAS,EACT,eAAe,EACf,YAAY,EACZ,iBAAiB,EACjB,gBAAgB,EAChB,eAAe,GAChB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAE9C,4EAA4E;AAC5E,qEAAqE;AACrE,8EAA8E;AAC9E,MAAM,eAAe,GAAG,yBAAyB,CAAC;AAClD,MAAM,cAAc,GAAG,6CAA6C,CAAC;AACrE,iFAAiF;AACjF,iFAAiF;AACjF,sEAAsE;AACtE,MAAM,gBAAgB,GAAG,oCAAoC,CAAC;AAC9D,MAAM,mBAAmB,GAAG,qCAAqC,CAAC;AAClE,MAAM,kBAAkB,GAAG,sCAAsC,CAAC;AAClE,MAAM,YAAY,GAAG,uCAAuC,CAAC;AAE7D,MAAM,iBAAiB,GAAa;IAClC,EAAE,EAAE,iBAAiB;IACrB,KAAK,EAAE,wCAAwC;IAC/C,WAAW,EAAE,oEAAoE;IACjF,QAAQ,EAAE,KAAK;IACf,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,KAAK;IAChB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EAAE,6EAA6E;IACtF,WAAW,EACT,yHAAyH;CAC5H,CAAC;AACF,MAAM,gBAAgB,GAAa;IACjC,EAAE,EAAE,gBAAgB;IACpB,KAAK,EAAE,uCAAuC;IAC9C,WAAW,EAAE,iFAAiF;IAC9F,8EAA8E;IAC9E,oFAAoF;IACpF,mFAAmF;IACnF,iFAAiF;IACjF,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,MAAM;IACjB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,qKAAqK;IACvK,WAAW,EACT,4HAA4H;CAC/H,CAAC;AACF,MAAM,kBAAkB,GAAa;IACnC,EAAE,EAAE,eAAe;IACnB,KAAK,EAAE,2BAA2B;IAClC,WAAW,EAAE,kFAAkF;IAC/F,QAAQ,EAAE,WAAW;IACrB,8EAA8E;IAC9E,+EAA+E;IAC/E,oCAAoC;IACpC,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,KAAK;IAChB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,6FAA6F;IAC/F,WAAW,EAAE,+EAA+E;CAC7F,CAAC;AACF,MAAM,qBAAqB,GAAa;IACtC,EAAE,EAAE,kBAAkB;IACtB,KAAK,EAAE,4BAA4B;IACnC,WAAW,EAAE,+DAA+D;IAC5E,QAAQ,EAAE,KAAK;IACf,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,KAAK;IAChB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,kGAAkG;IACpG,WAAW,EAAE,+EAA+E;CAC7F,CAAC;AACF,MAAM,oBAAoB,GAAa;IACrC,EAAE,EAAE,iBAAiB;IACrB,KAAK,EAAE,6BAA6B;IACpC,WAAW,EAAE,oFAAoF;IACjG,QAAQ,EAAE,WAAW;IACrB,iFAAiF;IACjF,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,OAAO;IAClB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,+FAA+F;IACjG,WAAW,EAAE,+EAA+E;CAC7F,CAAC;AACF,MAAM,cAAc,GAAa;IAC/B,EAAE,EAAE,WAAW;IACf,KAAK,EAAE,gCAAgC;IACvC,WAAW,EAAE,mEAAmE;IAChF,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,MAAM;IACjB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,4HAA4H;IAC9H,WAAW,EACT,6FAA6F;CAChG,CAAC;AAEF,qFAAqF;AACrF,MAAM,CAAC,MAAM,YAAY,GAAa;IACpC,EAAE,EAAE,aAAa;IACjB,WAAW,EAAE,gFAAgF;IAC7F,KAAK,EAAE,QAAQ;IACf,QAAQ,EAAE,MAAM;IAChB,KAAK,EAAE;QACL,iBAAiB;QACjB,gBAAgB;QAChB,kBAAkB;QAClB,qBAAqB;QACrB,oBAAoB;QACpB,cAAc;KACf;IACD,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,eAAe,CAAC;IAClD,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE;QACtB,6EAA6E;QAC7E,6EAA6E;QAC7E,IACE,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAC3B,CAAC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC;YACpC,CAAC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EACrC,CAAC;YACD,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,8EAA8E;QAC9E,4EAA4E;QAC5E,cAAc;QACd,MAAM,MAAM,GAAG,gBAAgB,CAAC,iBAAiB,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;QAEpE,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,8EAA8E;QAC9E,yEAAyE;QACzE,MAAM,GAAG,GAAG,CAAC,EAAU,EAAE,IAAc,EAAE,EAAE,CACzC,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAC1B,QAAQ,CAAC,IAAI,CACX,eAAe,CAAC,IAAI,EAAE;YACpB,IAAI;YACJ,OAAO;YACP,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM;SACzB,CAAC,CACH,CACF,CAAC;QACJ,GAAG,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAAC;QACxC,GAAG,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC;QACtC,GAAG,CAAC,gBAAgB,EAAE,kBAAkB,CAAC,CAAC;QAC1C,GAAG,CAAC,mBAAmB,EAAE,qBAAqB,CAAC,CAAC;QAChD,GAAG,CAAC,kBAAkB,EAAE,oBAAoB,CAAC,CAAC;QAC9C,GAAG,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;QAClC,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC","sourcesContent":["/**\n * Source detector for classical asymmetric cryptography in Objective-C on Apple\n * platforms (iOS / macOS / tvOS / watchOS), via the Security framework's\n * `SecKey*` API (and, underneath it, CommonCrypto). This is the Objective-C\n * sibling of the Swift pack: the same Security-framework surface, reached from\n * `.m` / `.mm` translation units instead of `.swift`. Lexical, same strategy as\n * the other language packs — the Security-framework identifiers\n * (`kSecAttrKeyType*`, `kSecKeyAlgorithm*`) are distinctive enough to keep the\n * false-positive risk low.\n *\n * WHY a dedicated Objective-C pack (and not the C/C++ pack):\n *  - The C/C++ pack (`c.ts`) matches OpenSSL / libsodium / Mbed TLS / wolfSSL\n *    symbols and is gated to `.c/.h/.cc/.cpp/...` (which INCLUDES `.h`). Apple's\n *    Security framework is a different API surface entirely, so a separate pack\n *    is the clean home for it.\n *  - Objective-C headers are `.h` — shared with C/C++. To avoid double-scanning\n *    a header the C pack already owns, this detector is gated to `.m` and `.mm`\n *    ONLY (implementation files). Declarations of `SecKey*` usage live in the\n *    implementation, not the interface, so no real coverage is lost.\n *\n * Security-framework surface mapped here:\n *  - Key generation attributes (`SecKeyCreateRandomKey` / `SecKeyGeneratePair`):\n *      `kSecAttrKeyTypeRSA`                         → RSA keygen (kem, hndl:true)\n *      `kSecAttrKeyTypeEC` / `…ECSECPrimeRandom`    → EC keygen (ECDSA, signature,\n *                                                     hndl:false — EC keys default\n *                                                     to signing; conservative)\n *  - Signing / verifying (`SecKeyCreateSignature` / `SecKeyVerifySignature`):\n *      `kSecKeyAlgorithmRSASignature*`              → RSA signature (hndl:false)\n *      `kSecKeyAlgorithmECDSASignature*`            → ECDSA signature (hndl:false)\n *  - Encryption / key agreement (`SecKeyCreateEncryptedData` / `SecKeyCopyKeyExchangeResult`):\n *      `kSecKeyAlgorithmRSAEncryption*`             → RSA encryption (kem, hndl:true)\n *      `kSecKeyAlgorithmECDHKeyExchange*`           → ECDH key agreement (hndl:true)\n *\n * Comment suppression is handled inline here (Objective-C is a C-style comment\n * language): C-style block comments and `//` line comments are masked before the\n * regexes run, so commented-out crypto never fires.\n */\nimport type { Detector, Finding, RuleMeta } from \"../types.js\";\nimport {\n  eachMatch,\n  findingFromRule,\n  hasExtension,\n  maskBlockComments,\n  maskCommentLines,\n  OBJC_EXTENSIONS,\n} from \"../detect-utils.js\";\nimport { CWE_BROKEN_CRYPTO } from \"../cwe.js\";\n\n// Security-framework key-type attributes (used with SecKeyCreateRandomKey /\n// SecKeyGeneratePair). RSA vs EC. The EC form covers both the modern\n// `kSecAttrKeyTypeECSECPrimeRandom` and the legacy `kSecAttrKeyTypeEC` alias.\nconst RE_OBJC_SEC_RSA = /\\bkSecAttrKeyTypeRSA\\b/g;\nconst RE_OBJC_SEC_EC = /\\bkSecAttrKeyType(?:ECSECPrimeRandom|EC)\\b/g;\n// SecKey algorithm constants for signing / encryption / key agreement. The `\\w*`\n// tail captures the full family suffix (…PKCS1v15SHA256, …OAEPSHA256, …Standard,\n// …CofactorX963SHA256, …) without needing to enumerate every variant.\nconst RE_OBJC_RSA_SIGN = /\\bkSecKeyAlgorithmRSASignature\\w*/g;\nconst RE_OBJC_RSA_ENCRYPT = /\\bkSecKeyAlgorithmRSAEncryption\\w*/g;\nconst RE_OBJC_ECDSA_SIGN = /\\bkSecKeyAlgorithmECDSASignature\\w*/g;\nconst RE_OBJC_ECDH = /\\bkSecKeyAlgorithmECDHKeyExchange\\w*/g;\n\nconst RULE_OBJC_SEC_RSA: RuleMeta = {\n  id: \"objc-seckey-rsa\",\n  title: \"Objective-C Security-framework RSA key\",\n  description: \"SecKeyCreateRandomKey / SecKeyGeneratePair with kSecAttrKeyTypeRSA\",\n  category: \"kem\",\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"RSA\",\n  hndl: true,\n  cwe: CWE_BROKEN_CRYPTO,\n  message: \"Security-framework RSA key (Objective-C) is classical and not quantum-safe.\",\n  remediation:\n    \"Migrate to PQC as Apple's CryptoKit / Security add support: ML-KEM for encryption/key-agreement, ML-DSA for signatures.\",\n};\nconst RULE_OBJC_SEC_EC: RuleMeta = {\n  id: \"objc-seckey-ec\",\n  title: \"Objective-C Security-framework EC key\",\n  description: \"SecKeyCreateRandomKey / SecKeyGeneratePair with kSecAttrKeyTypeECSECPrimeRandom\",\n  // An EC key at generation is AMBIGUOUS (it can feed ECDSA signing OR ECDH key\n  // agreement). The fleet convention (java-ec-keygen, python-ec-keygen, swift-sec-ec,\n  // cloud-kms-ec, …) classifies ambiguous EC keygen as key-exchange/ECDH/hndl:true —\n  // the HNDL-SAFE choice, so a possible key-agreement use is never under-reported.\n  category: \"key-exchange\",\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"ECDH\",\n  hndl: true,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"Security-framework EC key (Objective-C); EC keys feed ECDH key agreement (harvest-now-decrypt-later exposed) as well as ECDSA signatures, and are not quantum-safe.\",\n  remediation:\n    \"Migrate to PQC as Apple's CryptoKit / Security add support: ML-KEM for the ECDH key-agreement path, ML-DSA for signatures.\",\n};\nconst RULE_OBJC_RSA_SIGN: RuleMeta = {\n  id: \"objc-rsa-sign\",\n  title: \"Objective-C RSA signature\",\n  description: \"SecKeyCreateSignature / SecKeyVerifySignature with kSecKeyAlgorithmRSASignature*\",\n  category: \"signature\",\n  // `high`, consistent with every sibling pack's signature severity (swift-rsa,\n  // go-rsa-sign, java-rsa-sign) — the same primitive must not flip CI exit codes\n  // based on which language wrote it.\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"RSA\",\n  hndl: false,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"Classical RSA signing (Objective-C, Security framework) is forgeable by a quantum attacker.\",\n  remediation: \"Migrate to ML-DSA (FIPS 204) as Apple's CryptoKit / Security add PQC support.\",\n};\nconst RULE_OBJC_RSA_ENCRYPT: RuleMeta = {\n  id: \"objc-rsa-encrypt\",\n  title: \"Objective-C RSA encryption\",\n  description: \"SecKeyCreateEncryptedData with kSecKeyAlgorithmRSAEncryption*\",\n  category: \"kem\",\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"RSA\",\n  hndl: true,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"Classical RSA encryption (Objective-C, Security framework) is harvest-now-decrypt-later exposed.\",\n  remediation: \"Migrate to ML-KEM (FIPS 203) as Apple's CryptoKit / Security add PQC support.\",\n};\nconst RULE_OBJC_ECDSA_SIGN: RuleMeta = {\n  id: \"objc-ecdsa-sign\",\n  title: \"Objective-C ECDSA signature\",\n  description: \"SecKeyCreateSignature / SecKeyVerifySignature with kSecKeyAlgorithmECDSASignature*\",\n  category: \"signature\",\n  // `high`, consistent with swift-ecdsa / go-ecdsa / java-ecdsa-sign / dart-ecdsa.\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"ECDSA\",\n  hndl: false,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"Classical ECDSA signing (Objective-C, Security framework) is forgeable by a quantum attacker.\",\n  remediation: \"Migrate to ML-DSA (FIPS 204) as Apple's CryptoKit / Security add PQC support.\",\n};\nconst RULE_OBJC_ECDH: RuleMeta = {\n  id: \"objc-ecdh\",\n  title: \"Objective-C ECDH key agreement\",\n  description: \"SecKeyCopyKeyExchangeResult with kSecKeyAlgorithmECDHKeyExchange*\",\n  category: \"key-exchange\",\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"ECDH\",\n  hndl: true,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"Elliptic-curve Diffie-Hellman (Objective-C, Security framework) is broken by Shor's algorithm (harvest-now-decrypt-later).\",\n  remediation:\n    \"Migrate key agreement to ML-KEM (FIPS 203) as Apple's CryptoKit / Security add PQC support.\",\n};\n\n/** Detects classical asymmetric crypto in Objective-C (Apple Security framework). */\nexport const objcDetector: Detector = {\n  id: \"objc-crypto\",\n  description: \"Classical asymmetric crypto in Objective-C (Apple Security framework / SecKey)\",\n  scope: \"source\",\n  language: \"objc\",\n  rules: [\n    RULE_OBJC_SEC_RSA,\n    RULE_OBJC_SEC_EC,\n    RULE_OBJC_RSA_SIGN,\n    RULE_OBJC_RSA_ENCRYPT,\n    RULE_OBJC_ECDSA_SIGN,\n    RULE_OBJC_ECDH,\n  ],\n  appliesTo: (f) => hasExtension(f, OBJC_EXTENSIONS),\n  detect({ file, content }): Finding[] {\n    // Fast reject: none of the Security-framework surface can appear without one\n    // of these substrings, so most Objective-C files bail before any regex runs.\n    if (\n      !content.includes(\"SecKey\") &&\n      !content.includes(\"kSecAttrKeyType\") &&\n      !content.includes(\"kSecKeyAlgorithm\")\n    ) {\n      return [];\n    }\n    // Mask C-style block comments then `//` line comments so commented-out crypto\n    // does not fire. Both maskers preserve byte offsets, so finding line/column\n    // stay exact.\n    const masked = maskCommentLines(maskBlockComments(content), [\"//\"]);\n\n    const findings: Finding[] = [];\n    // Scan the masked text, but build the finding (its snippet) from the ORIGINAL\n    // `content` so a line with a trailing comment renders live, not blanked.\n    const add = (re: RegExp, rule: RuleMeta) =>\n      eachMatch(re, masked, (m) =>\n        findings.push(\n          findingFromRule(rule, {\n            file,\n            content,\n            index: m.index,\n            matchLength: m[0].length,\n          }),\n        ),\n      );\n    add(RE_OBJC_SEC_RSA, RULE_OBJC_SEC_RSA);\n    add(RE_OBJC_SEC_EC, RULE_OBJC_SEC_EC);\n    add(RE_OBJC_RSA_SIGN, RULE_OBJC_RSA_SIGN);\n    add(RE_OBJC_RSA_ENCRYPT, RULE_OBJC_RSA_ENCRYPT);\n    add(RE_OBJC_ECDSA_SIGN, RULE_OBJC_ECDSA_SIGN);\n    add(RE_OBJC_ECDH, RULE_OBJC_ECDH);\n    return findings;\n  },\n};\n"]}

package/dist/detectors/openpgp.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Config detector: BINARY OpenPGP key material and encrypted messages committed to
+ * a repository — `secring.gpg` / `pubring.gpg` / `.gpg` / `.pgp` / `.kbx`. Armored
+ * blocks (`-----BEGIN PGP …-----`, base64 text) are handled by the PEM/secrets
+ * detectors; this covers the BINARY packet form, which the scan pipeline now reads
+ * byte-preserving (latin1; see {@link ../walk.ts isKeystorePath}) so we can read
+ * packet tags and the public-key algorithm id.
+ *
+ * A committed OpenPGP SECRET key is the sharp finding: a classical private key
+ * (RSA/DSA/ElGamal/ECDSA/EdDSA/ECDH) in version control is exposed and
+ * retroactively un-fixable. A binary PGP-encrypted message (PKESK) is
+ * harvest-now-decrypt-later exposed. Secret-key matches are sensitive material, so
+ * reporters drop the (binary) snippet.
+ *
+ * Packet framing per RFC 4880/9580. The parser is pure and bounds-checked (fuzzed).
+ */
+import type { Detector } from "../types.js";
+/** Detects binary OpenPGP key material / messages and GnuPG keyboxes. */
+export declare const openpgpDetector: Detector;
+//# sourceMappingURL=openpgp.d.ts.map

package/dist/detectors/openpgp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"openpgp.d.ts","sourceRoot":"","sources":["../../src/detectors/openpgp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,EAAmB,QAAQ,EAAqB,MAAM,aAAa,CAAC;AAyIhF,yEAAyE;AACzE,eAAO,MAAM,eAAe,EAAE,QAuC7B,CAAC"}

package/dist/detectors/openpgp.js

@@ -0,0 +1,151 @@
+import { findingFromRule, hasExtension } from "../detect-utils.js";
+import { CWE_HARDCODED_KEY, CWE_BROKEN_CRYPTO } from "../cwe.js";
+const OPENPGP_EXTENSIONS = [".gpg", ".pgp"];
+// Packet tags we care about.
+const TAG_PKESK = 1; // public-key encrypted session key (an encrypted message)
+const TAG_SECRET_KEY = 5;
+const TAG_PUBLIC_KEY = 6;
+const TAG_SECRET_SUBKEY = 7;
+const TAG_PUBLIC_SUBKEY = 14;
+/** Parse the FIRST OpenPGP packet header; return its tag and body offset. */
+function firstPacket(content) {
+    if (content.length < 2)
+        return undefined;
+    const b0 = content.charCodeAt(0);
+    if ((b0 & 0x80) === 0)
+        return undefined; // high bit always set on a packet tag
+    if (b0 & 0x40) {
+        // New-format packet: tag is the low 6 bits; length octet(s) follow.
+        const tag = b0 & 0x3f;
+        const l = content.charCodeAt(1);
+        let bodyOffset;
+        if (l < 192)
+            bodyOffset = 2;
+        else if (l < 224)
+            bodyOffset = 3;
+        else if (l === 255)
+            bodyOffset = 6;
+        else
+            bodyOffset = 2; // partial-body length
+        return { tag, bodyOffset };
+    }
+    // Old-format packet: tag in bits 5-2; length-type in the low 2 bits.
+    const tag = (b0 >> 2) & 0x0f;
+    const lt = b0 & 0x03;
+    const bodyOffset = lt === 0 ? 2 : lt === 1 ? 3 : lt === 2 ? 5 : 1;
+    return { tag, bodyOffset };
+}
+/** Map an OpenPGP public-key algorithm id to a family + HNDL (confidentiality) flag. */
+function algo(id) {
+    switch (id) {
+        case 1:
+        case 2:
+        case 3:
+            return { family: "RSA", hndl: true }; // RSA (encrypt-capable)
+        case 16:
+        case 20:
+            return { family: "unknown", hndl: true }; // ElGamal (encrypt)
+        case 17:
+            return { family: "DSA", hndl: false }; // DSA (sign only)
+        case 18:
+            return { family: "ECDH", hndl: true }; // ECDH (encrypt)
+        case 19:
+            return { family: "ECDSA", hndl: false }; // ECDSA (sign only)
+        case 22:
+            return { family: "EdDSA", hndl: false }; // EdDSA (sign only)
+        // RFC 9580 (crypto-refresh) v6 algorithm ids.
+        case 25:
+            return { family: "X25519", hndl: true }; // X25519 (encrypt / key agreement)
+        case 26:
+            return { family: "X448", hndl: true }; // X448 (encrypt / key agreement)
+        case 27:
+            return { family: "EdDSA", hndl: false }; // Ed25519 (sign only)
+        case 28:
+            return { family: "EdDSA", hndl: false }; // Ed448 (sign only)
+        default:
+            return undefined;
+    }
+}
+/** Read the public-key algorithm id from a key packet body, or undefined. */
+function keyPacketAlgo(content, bodyOffset) {
+    if (bodyOffset >= content.length)
+        return undefined;
+    const version = content.charCodeAt(bodyOffset);
+    // v2/v3: version(1) created(4) validity(2) algo; v4/v5/v6: version(1) created(4) algo.
+    const algoOffset = version === 2 || version === 3 ? bodyOffset + 7 : bodyOffset + 5;
+    if (algoOffset >= content.length)
+        return undefined;
+    return content.charCodeAt(algoOffset);
+}
+/** Read the wrapping algorithm from a PKESK (encrypted-message) packet body. */
+function pkeskAlgo(content, bodyOffset) {
+    if (bodyOffset >= content.length)
+        return undefined;
+    const version = content.charCodeAt(bodyOffset);
+    // v3: version(1) keyid(8) algo. (v6 differs; v3 dominates on-disk.)
+    if (version !== 3)
+        return undefined;
+    const algoOffset = bodyOffset + 9;
+    if (algoOffset >= content.length)
+        return undefined;
+    return content.charCodeAt(algoOffset);
+}
+function rule(id, title, message, opts) {
+    return {
+        id,
+        title,
+        description: message,
+        category: "certificate",
+        severity: "high",
+        confidence: "high",
+        hndl: false,
+        cwe: CWE_HARDCODED_KEY,
+        message,
+        remediation: "Remove key material from version control and rotate it; store keys in a secret manager / HSM. Plan re-issuance with PQC keys (ML-DSA-65 / ML-KEM-768) as OpenPGP tooling supports them.",
+        ...opts,
+    };
+}
+const RULE_SECRET = rule("openpgp-secret-key", "OpenPGP secret key (binary)", "A binary OpenPGP SECRET key is committed to version control — a classical private key that is exposed and retroactively un-fixable.", { sensitive: true });
+const RULE_PUBLIC = rule("openpgp-public-key", "OpenPGP public key (binary)", "A binary OpenPGP public key uses classical asymmetric crypto (RSA/DSA/EC); plan a PQC migration path.", { severity: "medium" });
+const RULE_PKESK = rule("openpgp-encrypted-message", "OpenPGP-encrypted message (binary)", "A binary OpenPGP-encrypted message wraps its session key with classical asymmetric crypto (RSA/ElGamal/ECDH); harvest-now-decrypt-later exposed.", { category: "kem", hndl: true, cwe: CWE_BROKEN_CRYPTO });
+const RULE_KEYBOX = rule("openpgp-keybox", "GnuPG keybox (.kbx)", "A GnuPG keybox (.kbx) is a database of classical OpenPGP/X.509 keys and certificates.", { severity: "medium", cwe: CWE_BROKEN_CRYPTO });
+/** Detects binary OpenPGP key material / messages and GnuPG keyboxes. */
+export const openpgpDetector = {
+    id: "openpgp-material",
+    description: "Binary OpenPGP key material / encrypted messages and GnuPG keyboxes",
+    scope: "config",
+    language: "any",
+    rules: [RULE_SECRET, RULE_PUBLIC, RULE_PKESK, RULE_KEYBOX],
+    appliesTo: (f) => hasExtension(f, OPENPGP_EXTENSIONS) || f.toLowerCase().endsWith(".kbx"),
+    detect({ file, content }) {
+        const at = { file, content, index: 0, matchLength: Math.min(4, content.length) };
+        // GnuPG keybox: a key/cert database, identified by the "KBXf" magic in its
+        // first blob header (so a garbage/empty .kbx does not fire).
+        if (file.toLowerCase().endsWith(".kbx")) {
+            return content.includes("KBXf") ? [findingFromRule(RULE_KEYBOX, at)] : [];
+        }
+        const pkt = firstPacket(content);
+        if (!pkt)
+            return [];
+        const { tag, bodyOffset } = pkt;
+        if (tag === TAG_SECRET_KEY || tag === TAG_SECRET_SUBKEY) {
+            const id = keyPacketAlgo(content, bodyOffset);
+            const a = id !== undefined ? algo(id) : undefined;
+            return [
+                findingFromRule(RULE_SECRET, at, a ? { algorithm: a.family, hndl: a.hndl } : undefined),
+            ];
+        }
+        if (tag === TAG_PUBLIC_KEY || tag === TAG_PUBLIC_SUBKEY) {
+            const id = keyPacketAlgo(content, bodyOffset);
+            const a = id !== undefined ? algo(id) : undefined;
+            return [findingFromRule(RULE_PUBLIC, at, a ? { algorithm: a.family } : undefined)];
+        }
+        if (tag === TAG_PKESK) {
+            const id = pkeskAlgo(content, bodyOffset);
+            const a = id !== undefined ? algo(id) : undefined;
+            return [findingFromRule(RULE_PKESK, at, a ? { algorithm: a.family } : undefined)];
+        }
+        return [];
+    },
+};
+//# sourceMappingURL=openpgp.js.map

package/dist/detectors/openpgp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"openpgp.js","sourceRoot":"","sources":["../../src/detectors/openpgp.ts"],"names":[],"mappings":"AAiBA,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAEjE,MAAM,kBAAkB,GAAsB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAE/D,6BAA6B;AAC7B,MAAM,SAAS,GAAG,CAAC,CAAC,CAAC,0DAA0D;AAC/E,MAAM,cAAc,GAAG,CAAC,CAAC;AACzB,MAAM,cAAc,GAAG,CAAC,CAAC;AACzB,MAAM,iBAAiB,GAAG,CAAC,CAAC;AAC5B,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAQ7B,6EAA6E;AAC7E,SAAS,WAAW,CAAC,OAAe;IAClC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IACzC,MAAM,EAAE,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IACjC,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC,CAAC,sCAAsC;IAC/E,IAAI,EAAE,GAAG,IAAI,EAAE,CAAC;QACd,oEAAoE;QACpE,MAAM,GAAG,GAAG,EAAE,GAAG,IAAI,CAAC;QACtB,MAAM,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAChC,IAAI,UAAkB,CAAC;QACvB,IAAI,CAAC,GAAG,GAAG;YAAE,UAAU,GAAG,CAAC,CAAC;aACvB,IAAI,CAAC,GAAG,GAAG;YAAE,UAAU,GAAG,CAAC,CAAC;aAC5B,IAAI,CAAC,KAAK,GAAG;YAAE,UAAU,GAAG,CAAC,CAAC;;YAC9B,UAAU,GAAG,CAAC,CAAC,CAAC,sBAAsB;QAC3C,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC;IAC7B,CAAC;IACD,qEAAqE;IACrE,MAAM,GAAG,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;IAC7B,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IACrB,MAAM,UAAU,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClE,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC;AAC7B,CAAC;AAED,wFAAwF;AACxF,SAAS,IAAI,CAAC,EAAU;IACtB,QAAQ,EAAE,EAAE,CAAC;QACX,KAAK,CAAC,CAAC;QACP,KAAK,CAAC,CAAC;QACP,KAAK,CAAC;YACJ,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,wBAAwB;QAChE,KAAK,EAAE,CAAC;QACR,KAAK,EAAE;YACL,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,oBAAoB;QAChE,KAAK,EAAE;YACL,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,kBAAkB;QAC3D,KAAK,EAAE;YACL,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,iBAAiB;QAC1D,KAAK,EAAE;YACL,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,oBAAoB;QAC/D,KAAK,EAAE;YACL,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,oBAAoB;QAC/D,8CAA8C;QAC9C,KAAK,EAAE;YACL,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,mCAAmC;QAC9E,KAAK,EAAE;YACL,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,iCAAiC;QAC1E,KAAK,EAAE;YACL,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,sBAAsB;QACjE,KAAK,EAAE;YACL,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,oBAAoB;QAC/D;YACE,OAAO,SAAS,CAAC;IACrB,CAAC;AACH,CAAC;AAED,6EAA6E;AAC7E,SAAS,aAAa,CAAC,OAAe,EAAE,UAAkB;IACxD,IAAI,UAAU,IAAI,OAAO,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IACnD,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;IAC/C,uFAAuF;IACvF,MAAM,UAAU,GAAG,OAAO,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC;IACpF,IAAI,UAAU,IAAI,OAAO,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IACnD,OAAO,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;AACxC,CAAC;AAED,gFAAgF;AAChF,SAAS,SAAS,CAAC,OAAe,EAAE,UAAkB;IACpD,IAAI,UAAU,IAAI,OAAO,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IACnD,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;IAC/C,oEAAoE;IACpE,IAAI,OAAO,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACpC,MAAM,UAAU,GAAG,UAAU,GAAG,CAAC,CAAC;IAClC,IAAI,UAAU,IAAI,OAAO,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IACnD,OAAO,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;AACxC,CAAC;AAED,SAAS,IAAI,CAAC,EAAU,EAAE,KAAa,EAAE,OAAe,EAAE,IAAuB;IAC/E,OAAO;QACL,EAAE;QACF,KAAK;QACL,WAAW,EAAE,OAAO;QACpB,QAAQ,EAAE,aAAa;QACvB,QAAQ,EAAE,MAAM;QAChB,UAAU,EAAE,MAAM;QAClB,IAAI,EAAE,KAAK;QACX,GAAG,EAAE,iBAAiB;QACtB,OAAO;QACP,WAAW,EACT,yLAAyL;QAC3L,GAAG,IAAI;KACR,CAAC;AACJ,CAAC;AAED,MAAM,WAAW,GAAG,IAAI,CACtB,oBAAoB,EACpB,6BAA6B,EAC7B,qIAAqI,EACrI,EAAE,SAAS,EAAE,IAAI,EAAE,CACpB,CAAC;AACF,MAAM,WAAW,GAAG,IAAI,CACtB,oBAAoB,EACpB,6BAA6B,EAC7B,uGAAuG,EACvG,EAAE,QAAQ,EAAE,QAAQ,EAAE,CACvB,CAAC;AACF,MAAM,UAAU,GAAG,IAAI,CACrB,2BAA2B,EAC3B,oCAAoC,EACpC,kJAAkJ,EAClJ,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,iBAAiB,EAAE,CACxD,CAAC;AACF,MAAM,WAAW,GAAG,IAAI,CACtB,gBAAgB,EAChB,qBAAqB,EACrB,uFAAuF,EACvF,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,EAAE,iBAAiB,EAAE,CAC/C,CAAC;AAEF,yEAAyE;AACzE,MAAM,CAAC,MAAM,eAAe,GAAa;IACvC,EAAE,EAAE,kBAAkB;IACtB,WAAW,EAAE,qEAAqE;IAClF,KAAK,EAAE,QAAQ;IACf,QAAQ,EAAE,KAAK;IACf,KAAK,EAAE,CAAC,WAAW,EAAE,WAAW,EAAE,UAAU,EAAE,WAAW,CAAC;IAC1D,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,kBAAkB,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC;IACzF,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE;QACtB,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAEjF,2EAA2E;QAC3E,6DAA6D;QAC7D,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACxC,OAAO,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5E,CAAC;QAED,MAAM,GAAG,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;QACjC,IAAI,CAAC,GAAG;YAAE,OAAO,EAAE,CAAC;QACpB,MAAM,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,GAAG,CAAC;QAEhC,IAAI,GAAG,KAAK,cAAc,IAAI,GAAG,KAAK,iBAAiB,EAAE,CAAC;YACxD,MAAM,EAAE,GAAG,aAAa,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;YAC9C,MAAM,CAAC,GAAG,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAClD,OAAO;gBACL,eAAe,CAAC,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;aACxF,CAAC;QACJ,CAAC;QACD,IAAI,GAAG,KAAK,cAAc,IAAI,GAAG,KAAK,iBAAiB,EAAE,CAAC;YACxD,MAAM,EAAE,GAAG,aAAa,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;YAC9C,MAAM,CAAC,GAAG,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAClD,OAAO,CAAC,eAAe,CAAC,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;QACrF,CAAC;QACD,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,MAAM,EAAE,GAAG,SAAS,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;YAC1C,MAAM,CAAC,GAAG,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAClD,OAAO,CAAC,eAAe,CAAC,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;QACpF,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;CACF,CAAC","sourcesContent":["/**\n * Config detector: BINARY OpenPGP key material and encrypted messages committed to\n * a repository — `secring.gpg` / `pubring.gpg` / `.gpg` / `.pgp` / `.kbx`. Armored\n * blocks (`-----BEGIN PGP …-----`, base64 text) are handled by the PEM/secrets\n * detectors; this covers the BINARY packet form, which the scan pipeline now reads\n * byte-preserving (latin1; see {@link ../walk.ts isKeystorePath}) so we can read\n * packet tags and the public-key algorithm id.\n *\n * A committed OpenPGP SECRET key is the sharp finding: a classical private key\n * (RSA/DSA/ElGamal/ECDSA/EdDSA/ECDH) in version control is exposed and\n * retroactively un-fixable. A binary PGP-encrypted message (PKESK) is\n * harvest-now-decrypt-later exposed. Secret-key matches are sensitive material, so\n * reporters drop the (binary) snippet.\n *\n * Packet framing per RFC 4880/9580. The parser is pure and bounds-checked (fuzzed).\n */\nimport type { AlgorithmFamily, Detector, Finding, RuleMeta } from \"../types.js\";\nimport { findingFromRule, hasExtension } from \"../detect-utils.js\";\nimport { CWE_HARDCODED_KEY, CWE_BROKEN_CRYPTO } from \"../cwe.js\";\n\nconst OPENPGP_EXTENSIONS: readonly string[] = [\".gpg\", \".pgp\"];\n\n// Packet tags we care about.\nconst TAG_PKESK = 1; // public-key encrypted session key (an encrypted message)\nconst TAG_SECRET_KEY = 5;\nconst TAG_PUBLIC_KEY = 6;\nconst TAG_SECRET_SUBKEY = 7;\nconst TAG_PUBLIC_SUBKEY = 14;\n\ninterface Packet {\n  tag: number;\n  /** Offset where the packet body begins (after the length octets). */\n  bodyOffset: number;\n}\n\n/** Parse the FIRST OpenPGP packet header; return its tag and body offset. */\nfunction firstPacket(content: string): Packet | undefined {\n  if (content.length < 2) return undefined;\n  const b0 = content.charCodeAt(0);\n  if ((b0 & 0x80) === 0) return undefined; // high bit always set on a packet tag\n  if (b0 & 0x40) {\n    // New-format packet: tag is the low 6 bits; length octet(s) follow.\n    const tag = b0 & 0x3f;\n    const l = content.charCodeAt(1);\n    let bodyOffset: number;\n    if (l < 192) bodyOffset = 2;\n    else if (l < 224) bodyOffset = 3;\n    else if (l === 255) bodyOffset = 6;\n    else bodyOffset = 2; // partial-body length\n    return { tag, bodyOffset };\n  }\n  // Old-format packet: tag in bits 5-2; length-type in the low 2 bits.\n  const tag = (b0 >> 2) & 0x0f;\n  const lt = b0 & 0x03;\n  const bodyOffset = lt === 0 ? 2 : lt === 1 ? 3 : lt === 2 ? 5 : 1;\n  return { tag, bodyOffset };\n}\n\n/** Map an OpenPGP public-key algorithm id to a family + HNDL (confidentiality) flag. */\nfunction algo(id: number): { family: AlgorithmFamily; hndl: boolean } | undefined {\n  switch (id) {\n    case 1:\n    case 2:\n    case 3:\n      return { family: \"RSA\", hndl: true }; // RSA (encrypt-capable)\n    case 16:\n    case 20:\n      return { family: \"unknown\", hndl: true }; // ElGamal (encrypt)\n    case 17:\n      return { family: \"DSA\", hndl: false }; // DSA (sign only)\n    case 18:\n      return { family: \"ECDH\", hndl: true }; // ECDH (encrypt)\n    case 19:\n      return { family: \"ECDSA\", hndl: false }; // ECDSA (sign only)\n    case 22:\n      return { family: \"EdDSA\", hndl: false }; // EdDSA (sign only)\n    // RFC 9580 (crypto-refresh) v6 algorithm ids.\n    case 25:\n      return { family: \"X25519\", hndl: true }; // X25519 (encrypt / key agreement)\n    case 26:\n      return { family: \"X448\", hndl: true }; // X448 (encrypt / key agreement)\n    case 27:\n      return { family: \"EdDSA\", hndl: false }; // Ed25519 (sign only)\n    case 28:\n      return { family: \"EdDSA\", hndl: false }; // Ed448 (sign only)\n    default:\n      return undefined;\n  }\n}\n\n/** Read the public-key algorithm id from a key packet body, or undefined. */\nfunction keyPacketAlgo(content: string, bodyOffset: number): number | undefined {\n  if (bodyOffset >= content.length) return undefined;\n  const version = content.charCodeAt(bodyOffset);\n  // v2/v3: version(1) created(4) validity(2) algo; v4/v5/v6: version(1) created(4) algo.\n  const algoOffset = version === 2 || version === 3 ? bodyOffset + 7 : bodyOffset + 5;\n  if (algoOffset >= content.length) return undefined;\n  return content.charCodeAt(algoOffset);\n}\n\n/** Read the wrapping algorithm from a PKESK (encrypted-message) packet body. */\nfunction pkeskAlgo(content: string, bodyOffset: number): number | undefined {\n  if (bodyOffset >= content.length) return undefined;\n  const version = content.charCodeAt(bodyOffset);\n  // v3: version(1) keyid(8) algo. (v6 differs; v3 dominates on-disk.)\n  if (version !== 3) return undefined;\n  const algoOffset = bodyOffset + 9;\n  if (algoOffset >= content.length) return undefined;\n  return content.charCodeAt(algoOffset);\n}\n\nfunction rule(id: string, title: string, message: string, opts: Partial<RuleMeta>): RuleMeta {\n  return {\n    id,\n    title,\n    description: message,\n    category: \"certificate\",\n    severity: \"high\",\n    confidence: \"high\",\n    hndl: false,\n    cwe: CWE_HARDCODED_KEY,\n    message,\n    remediation:\n      \"Remove key material from version control and rotate it; store keys in a secret manager / HSM. Plan re-issuance with PQC keys (ML-DSA-65 / ML-KEM-768) as OpenPGP tooling supports them.\",\n    ...opts,\n  };\n}\n\nconst RULE_SECRET = rule(\n  \"openpgp-secret-key\",\n  \"OpenPGP secret key (binary)\",\n  \"A binary OpenPGP SECRET key is committed to version control — a classical private key that is exposed and retroactively un-fixable.\",\n  { sensitive: true },\n);\nconst RULE_PUBLIC = rule(\n  \"openpgp-public-key\",\n  \"OpenPGP public key (binary)\",\n  \"A binary OpenPGP public key uses classical asymmetric crypto (RSA/DSA/EC); plan a PQC migration path.\",\n  { severity: \"medium\" },\n);\nconst RULE_PKESK = rule(\n  \"openpgp-encrypted-message\",\n  \"OpenPGP-encrypted message (binary)\",\n  \"A binary OpenPGP-encrypted message wraps its session key with classical asymmetric crypto (RSA/ElGamal/ECDH); harvest-now-decrypt-later exposed.\",\n  { category: \"kem\", hndl: true, cwe: CWE_BROKEN_CRYPTO },\n);\nconst RULE_KEYBOX = rule(\n  \"openpgp-keybox\",\n  \"GnuPG keybox (.kbx)\",\n  \"A GnuPG keybox (.kbx) is a database of classical OpenPGP/X.509 keys and certificates.\",\n  { severity: \"medium\", cwe: CWE_BROKEN_CRYPTO },\n);\n\n/** Detects binary OpenPGP key material / messages and GnuPG keyboxes. */\nexport const openpgpDetector: Detector = {\n  id: \"openpgp-material\",\n  description: \"Binary OpenPGP key material / encrypted messages and GnuPG keyboxes\",\n  scope: \"config\",\n  language: \"any\",\n  rules: [RULE_SECRET, RULE_PUBLIC, RULE_PKESK, RULE_KEYBOX],\n  appliesTo: (f) => hasExtension(f, OPENPGP_EXTENSIONS) || f.toLowerCase().endsWith(\".kbx\"),\n  detect({ file, content }): Finding[] {\n    const at = { file, content, index: 0, matchLength: Math.min(4, content.length) };\n\n    // GnuPG keybox: a key/cert database, identified by the \"KBXf\" magic in its\n    // first blob header (so a garbage/empty .kbx does not fire).\n    if (file.toLowerCase().endsWith(\".kbx\")) {\n      return content.includes(\"KBXf\") ? [findingFromRule(RULE_KEYBOX, at)] : [];\n    }\n\n    const pkt = firstPacket(content);\n    if (!pkt) return [];\n    const { tag, bodyOffset } = pkt;\n\n    if (tag === TAG_SECRET_KEY || tag === TAG_SECRET_SUBKEY) {\n      const id = keyPacketAlgo(content, bodyOffset);\n      const a = id !== undefined ? algo(id) : undefined;\n      return [\n        findingFromRule(RULE_SECRET, at, a ? { algorithm: a.family, hndl: a.hndl } : undefined),\n      ];\n    }\n    if (tag === TAG_PUBLIC_KEY || tag === TAG_PUBLIC_SUBKEY) {\n      const id = keyPacketAlgo(content, bodyOffset);\n      const a = id !== undefined ? algo(id) : undefined;\n      return [findingFromRule(RULE_PUBLIC, at, a ? { algorithm: a.family } : undefined)];\n    }\n    if (tag === TAG_PKESK) {\n      const id = pkeskAlgo(content, bodyOffset);\n      const a = id !== undefined ? algo(id) : undefined;\n      return [findingFromRule(RULE_PKESK, at, a ? { algorithm: a.family } : undefined)];\n    }\n    return [];\n  },\n};\n"]}

package/dist/detectors/pem.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pem.d.ts","sourceRoot":"","sources":["../../src/detectors/pem.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAqB,MAAM,aAAa,CAAC;AA4M/D,+DAA+D;AAC/D,eAAO,MAAM,WAAW,EAAE,QA2BzB,CAAC"}
+{"version":3,"file":"pem.d.ts","sourceRoot":"","sources":["../../src/detectors/pem.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAqB,MAAM,aAAa,CAAC;AAqO/D,+DAA+D;AAC/D,eAAO,MAAM,WAAW,EAAE,QAgCzB,CAAC"}

package/dist/detectors/pem.js

@@ -184,6 +184,32 @@ const PEM_RULES = [
         },
     },
 ];
+/**
+ * True when what follows the begin marker looks like a REAL PEM block rather than a
+ * `-----BEGIN …-----` header STRING LITERAL (as appears in PEM parsers, tests, and
+ * i18n messages). `from` points just past the begin marker. Three accepting signals:
+ *
+ *  (a) a full LINE of base64 (≥24 chars, optional `=` padding) — real multi-line PEM
+ *      bodies are line-wrapped base64; requiring the whole line to be base64 stops a
+ *      long camelCase identifier on a code line from validating a bare header constant.
+ *  (b) an ESCAPED-newline base64 run (`\n<base64>`, a LITERAL backslash-n) — a key
+ *      embedded in a single-line JSON/.env string (GCP service accounts, `PRIVATE_KEY=
+ *      "…\n…"`), whose body can run past the window before its `-----END`. The literal
+ *      `\n` escape distinguishes it from a source constant, which has a REAL newline.
+ *  (c) a matching `-----END …-----` marker with NO double-quote between it and the
+ *      begin marker. This admits short/placeholder bodies (`x`, `abc`, `MIIB` in tests)
+ *      while rejecting a parser's PAIRED header/footer constants, whose intervening
+ *      `";` … `= "` always contains a `"` — a char a real PEM body never holds.
+ */
+function hasBase64Body(content, from) {
+    const window = content.slice(from, from + 800);
+    if (/^[ \t]*[A-Za-z0-9+/]{24,}={0,2}[ \t]*$/m.test(window))
+        return true;
+    if (/\\n[A-Za-z0-9+/]{24,}/.test(window))
+        return true;
+    const end = window.search(/-----END [A-Z0-9 ]+-----/);
+    return end >= 0 && !window.slice(0, end).includes('"');
+}
 /** Detects PEM key/certificate material in arbitrary files. */
 export const pemDetector = {
     id: "pem-material",
@@ -200,6 +226,12 @@ export const pemDetector = {
         const findings = [];
         for (const rule of PEM_RULES) {
             eachMatch(rule.re, content, (m) => {
+                // Require an actual base64 body after the marker, so a bare
+                // `-----BEGIN RSA PRIVATE KEY-----` string literal in a PEM parser / test /
+                // i18n message does NOT get reported as an embedded key. A real PEM block has
+                // a run of base64 within the next few hundred chars.
+                if (!hasBase64Body(content, m.index + m[0].length))
+                    return;
                 findings.push(findingFromRule(rule.meta, {
                     file,
                     content,

package/dist/detectors/pem.js.map

@@ -1 +1 @@
-{"version":3,"file":"pem.js","sourceRoot":"","sources":["../../src/detectors/pem.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAChE,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AASjE,MAAM,SAAS,GAAc;IAC3B;QACE,EAAE,EAAE,kCAAkC;QACtC,IAAI,EAAE;YACJ,EAAE,EAAE,qBAAqB;YACzB,KAAK,EAAE,uBAAuB;YAC9B,WAAW,EAAE,8BAA8B;YAC3C,QAAQ,EAAE,aAAa;YACvB,QAAQ,EAAE,UAAU;YACpB,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,KAAK;YAChB,IAAI,EAAE,IAAI;YACV,GAAG,EAAE,iBAAiB;YACtB,SAAS,EAAE,IAAI;YACf,OAAO,EAAE,wEAAwE;YACjF,WAAW,EAAE,+EAA+E;SAC7F;KACF;IACD;QACE,EAAE,EAAE,iCAAiC;QACrC,IAAI,EAAE;YACJ,EAAE,EAAE,oBAAoB;YACxB,KAAK,EAAE,sBAAsB;YAC7B,WAAW,EAAE,2BAA2B;YACxC,QAAQ,EAAE,aAAa;YACvB,QAAQ,EAAE,UAAU;YACpB,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,OAAO;YAClB,IAAI,EAAE,IAAI;YACV,GAAG,EAAE,iBAAiB;YACtB,SAAS,EAAE,IAAI;YACf,OAAO,EAAE,iFAAiF;YAC1F,WAAW,EACT,mIAAmI;SACtI;KACF;IACD;QACE,EAAE,EAAE,kCAAkC;QACtC,IAAI,EAAE;YACJ,EAAE,EAAE,qBAAqB;YACzB,KAAK,EAAE,uBAAuB;YAC9B,WAAW,EAAE,uBAAuB;YACpC,QAAQ,EAAE,aAAa;YACvB,QAAQ,EAAE,UAAU;YACpB,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,KAAK;YAChB,IAAI,EAAE,KAAK;YACX,GAAG,EAAE,iBAAiB;YACtB,SAAS,EAAE,IAAI;YACf,OAAO,EACL,sFAAsF;YACxF,WAAW,EAAE,6EAA6E;SAC3F;KACF;IACD;QACE,EAAE,EAAE,sCAAsC;QAC1C,IAAI,EAAE;YACJ,EAAE,EAAE,yBAAyB;YAC7B,KAAK,EAAE,qBAAqB;YAC5B,WAAW,EAAE,2BAA2B;YACxC,QAAQ,EAAE,aAAa;YACvB,QAAQ,EAAE,UAAU;YACpB,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,SAAS;YACpB,IAAI,EAAE,IAAI;YACV,GAAG,EAAE,iBAAiB;YACtB,SAAS,EAAE,IAAI;YACf,OAAO,EAAE,mFAAmF;YAC5F,WAAW,EACT,gIAAgI;SACnI;KACF;IACD;QACE,EAAE,EAAE,wCAAwC;QAC5C,IAAI,EAAE;YACJ,EAAE,EAAE,qBAAqB;YACzB,KAAK,EAAE,2BAA2B;YAClC,WAAW,EAAE,2BAA2B;YACxC,QAAQ,EAAE,aAAa;YACvB,QAAQ,EAAE,UAAU;YACpB,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,SAAS;YACpB,IAAI,EAAE,IAAI;YACV,GAAG,EAAE,iBAAiB;YACtB,SAAS,EAAE,IAAI;YACf,OAAO,EACL,+FAA+F;YACjG,WAAW,EAAE,yDAAyD;SACvE;KACF;IACD;QACE,EAAE,EAAE,8BAA8B;QAClC,IAAI,EAAE;YACJ,EAAE,EAAE,iBAAiB;YACrB,KAAK,EAAE,2BAA2B;YAClC,WAAW,EAAE,iCAAiC;YAC9C,QAAQ,EAAE,aAAa;YACvB,QAAQ,EAAE,KAAK;YACf,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,SAAS;YACpB,IAAI,EAAE,IAAI;YACV,GAAG,EAAE,iBAAiB;YACtB,OAAO,EACL,oGAAoG;YACtG,WAAW,EAAE,qEAAqE;SACnF;KACF;IACD;QACE,EAAE,EAAE,6CAA6C;QACjD,IAAI,EAAE;YACJ,EAAE,EAAE,uBAAuB;YAC3B,KAAK,EAAE,0BAA0B;YACjC,WAAW,EAAE,0BAA0B;YACvC,QAAQ,EAAE,aAAa;YACvB,QAAQ,EAAE,UAAU;YACpB,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,SAAS;YACpB,IAAI,EAAE,IAAI;YACV,GAAG,EAAE,iBAAiB;YACtB,SAAS,EAAE,IAAI;YACf,OAAO,EAAE,yEAAyE;YAClF,WAAW,EAAE,mEAAmE;SACjF;KACF;IACD;QACE,EAAE,EAAE,8BAA8B;QAClC,IAAI,EAAE;YACJ,EAAE,EAAE,iBAAiB;YACrB,KAAK,EAAE,yBAAyB;YAChC,WAAW,EAAE,yBAAyB;YACtC,QAAQ,EAAE,aAAa;YACvB,QAAQ,EAAE,KAAK;YACf,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,SAAS;YACpB,IAAI,EAAE,KAAK;YACX,GAAG,EAAE,iBAAiB;YACtB,OAAO,EAAE,+EAA+E;YACxF,WAAW,EAAE,8EAA8E;SAC5F;KACF;IACD;QACE,EAAE,EAAE,sCAAsC;QAC1C,IAAI,EAAE;YACJ,EAAE,EAAE,gBAAgB;YACpB,KAAK,EAAE,4BAA4B;YACnC,WAAW,EAAE,oDAAoD;YACjE,QAAQ,EAAE,aAAa;YACvB,QAAQ,EAAE,KAAK;YACf,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,SAAS;YACpB,IAAI,EAAE,KAAK;YACX,GAAG,EAAE,iBAAiB;YACtB,OAAO,EACL,gIAAgI;YAClI,WAAW,EAAE,wEAAwE;SACtF;KACF;IACD;QACE,EAAE,EAAE,gCAAgC;QACpC,IAAI,EAAE;YACJ,EAAE,EAAE,mBAAmB;YACvB,KAAK,EAAE,iCAAiC;YACxC,WAAW,EAAE,wCAAwC;YACrD,QAAQ,EAAE,cAAc;YACxB,QAAQ,EAAE,QAAQ;YAClB,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,IAAI;YACf,IAAI,EAAE,IAAI;YACV,GAAG,EAAE,iBAAiB;YACtB,OAAO,EACL,kHAAkH;YACpH,WAAW,EAAE,6DAA6D;SAC3E;KACF;IACD;QACE,EAAE,EAAE,+CAA+C;QACnD,IAAI,EAAE;YACJ,EAAE,EAAE,kBAAkB;YACtB,KAAK,EAAE,mCAAmC;YAC1C,WAAW,EAAE,mCAAmC;YAChD,QAAQ,EAAE,aAAa;YACvB,QAAQ,EAAE,KAAK;YACf,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,SAAS;YACpB,IAAI,EAAE,KAAK;YACX,GAAG,EAAE,iBAAiB;YACtB,OAAO,EACL,gGAAgG;YAClG,WAAW,EAAE,sDAAsD;SACpE;KACF;CACF,CAAC;AAEF,+DAA+D;AAC/D,MAAM,CAAC,MAAM,WAAW,GAAa;IACnC,EAAE,EAAE,cAAc;IAClB,WAAW,EAAE,6DAA6D;IAC1E,KAAK,EAAE,QAAQ;IACf,QAAQ,EAAE,KAAK;IACf,KAAK,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACnC,uEAAuE;IACvE,SAAS,EAAE,GAAG,EAAE,CAAC,IAAI;IACrB,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE;QACtB,+DAA+D;QAC/D,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC;YAAE,OAAO,EAAE,CAAC;QAEhD,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;YAC7B,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;gBAChC,QAAQ,CAAC,IAAI,CACX,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE;oBACzB,IAAI;oBACJ,OAAO;oBACP,KAAK,EAAE,CAAC,CAAC,KAAK;oBACd,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM;iBACzB,CAAC,CACH,CAAC;YACJ,CAAC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC","sourcesContent":["/**\n * Config / certificate detector: finds PEM-encoded cryptographic material in\n * any text file (source, config, .pem, .key, .crt, .env, …). This catches\n * embedded private keys and X.509 certificates regardless of language.\n *\n * Every rule's metadata lives in the {@link RuleMeta} declaration below (the\n * catalog entry); `detect()` builds findings straight from it via\n * `findingFromRule`. All PEM findings are high-confidence exact-marker matches.\n */\nimport type { Detector, Finding, RuleMeta } from \"../types.js\";\nimport { eachMatch, findingFromRule } from \"../detect-utils.js\";\nimport { CWE_BROKEN_CRYPTO, CWE_HARDCODED_KEY } from \"../cwe.js\";\n\n/** A PEM rule: its catalog metadata plus the begin-marker regex that triggers it. */\ninterface PemRule {\n  /** Regex matching the PEM begin marker. */\n  re: RegExp;\n  meta: RuleMeta;\n}\n\nconst PEM_RULES: PemRule[] = [\n  {\n    re: /-----BEGIN RSA PRIVATE KEY-----/g,\n    meta: {\n      id: \"pem-rsa-private-key\",\n      title: \"RSA private key (PEM)\",\n      description: \"PKCS#1 RSA private key block\",\n      category: \"certificate\",\n      severity: \"critical\",\n      confidence: \"high\",\n      algorithm: \"RSA\",\n      hndl: true,\n      cwe: CWE_HARDCODED_KEY,\n      sensitive: true,\n      message: \"Embedded RSA private key (PKCS#1 PEM); classical and not quantum-safe.\",\n      remediation: \"Migrate to ML-DSA / ML-KEM keys and remove embedded private keys from source.\",\n    },\n  },\n  {\n    re: /-----BEGIN EC PRIVATE KEY-----/g,\n    meta: {\n      id: \"pem-ec-private-key\",\n      title: \"EC private key (PEM)\",\n      description: \"SEC1 EC private key block\",\n      category: \"certificate\",\n      severity: \"critical\",\n      confidence: \"high\",\n      algorithm: \"ECDSA\",\n      hndl: true,\n      cwe: CWE_HARDCODED_KEY,\n      sensitive: true,\n      message: \"Embedded EC private key (SEC1 PEM); classical ECDSA/ECDH key, not quantum-safe.\",\n      remediation:\n        \"Migrate to ML-DSA (FIPS 204) for signatures or hybrid X25519MLKEM768 for key agreement; remove embedded private keys from source.\",\n    },\n  },\n  {\n    re: /-----BEGIN DSA PRIVATE KEY-----/g,\n    meta: {\n      id: \"pem-dsa-private-key\",\n      title: \"DSA private key (PEM)\",\n      description: \"DSA private key block\",\n      category: \"certificate\",\n      severity: \"critical\",\n      confidence: \"high\",\n      algorithm: \"DSA\",\n      hndl: false,\n      cwe: CWE_HARDCODED_KEY,\n      sensitive: true,\n      message:\n        \"Embedded DSA private key (PEM); classical, already deprecated, and not quantum-safe.\",\n      remediation: \"Rotate immediately (DSA is deprecated) and migrate to ML-DSA-65 (FIPS 204).\",\n    },\n  },\n  {\n    re: /-----BEGIN OPENSSH PRIVATE KEY-----/g,\n    meta: {\n      id: \"pem-openssh-private-key\",\n      title: \"OpenSSH private key\",\n      description: \"OpenSSH private key block\",\n      category: \"certificate\",\n      severity: \"critical\",\n      confidence: \"high\",\n      algorithm: \"unknown\",\n      hndl: true,\n      cwe: CWE_HARDCODED_KEY,\n      sensitive: true,\n      message: \"Embedded OpenSSH private key (RSA/ECDSA/Ed25519); classical and not quantum-safe.\",\n      remediation:\n        \"Rotate the key; plan migration to PQC-capable SSH (prefer the mlkem768x25519-sha256 KEX, OpenSSH 10's default since Apr 2025).\",\n    },\n  },\n  {\n    re: /-----BEGIN PGP PRIVATE KEY BLOCK-----/g,\n    meta: {\n      id: \"pem-pgp-private-key\",\n      title: \"PGP/GPG private key block\",\n      description: \"OpenPGP private key block\",\n      category: \"certificate\",\n      severity: \"critical\",\n      confidence: \"high\",\n      algorithm: \"unknown\",\n      hndl: true,\n      cwe: CWE_HARDCODED_KEY,\n      sensitive: true,\n      message:\n        \"Embedded PGP/GPG private key block (RSA/ECDSA/EdDSA/ElGamal); classical and not quantum-safe.\",\n      remediation: \"Rotate the key; track OpenPGP PQC drafts for migration.\",\n    },\n  },\n  {\n    re: /-----BEGIN PGP MESSAGE-----/g,\n    meta: {\n      id: \"pem-pgp-message\",\n      title: \"PGP/GPG encrypted message\",\n      description: \"OpenPGP encrypted message block\",\n      category: \"certificate\",\n      severity: \"low\",\n      confidence: \"high\",\n      algorithm: \"unknown\",\n      hndl: true,\n      cwe: CWE_BROKEN_CRYPTO,\n      message:\n        \"Embedded PGP/GPG message; likely encrypted with classical RSA/ElGamal (harvest-now-decrypt-later).\",\n      remediation: \"Re-encrypt with PQC-capable tooling as OpenPGP PQC profiles mature.\",\n    },\n  },\n  {\n    re: /-----BEGIN (?:ENCRYPTED )?PRIVATE KEY-----/g,\n    meta: {\n      id: \"pem-pkcs8-private-key\",\n      title: \"Private key (PKCS#8 PEM)\",\n      description: \"PKCS#8 private key block\",\n      category: \"certificate\",\n      severity: \"critical\",\n      confidence: \"high\",\n      algorithm: \"unknown\",\n      hndl: true,\n      cwe: CWE_HARDCODED_KEY,\n      sensitive: true,\n      message: \"Embedded PKCS#8 private key; likely classical RSA/EC, not quantum-safe.\",\n      remediation: \"Migrate to PQC keys and remove embedded private keys from source.\",\n    },\n  },\n  {\n    re: /-----BEGIN CERTIFICATE-----/g,\n    meta: {\n      id: \"pem-certificate\",\n      title: \"X.509 certificate (PEM)\",\n      description: \"X.509 certificate block\",\n      category: \"certificate\",\n      severity: \"low\",\n      confidence: \"high\",\n      algorithm: \"unknown\",\n      hndl: false,\n      cwe: CWE_BROKEN_CRYPTO,\n      message: \"Embedded X.509 certificate; almost certainly signed with classical RSA/ECDSA.\",\n      remediation: \"Plan re-issuance with PQC-capable CAs as ML-DSA certificate profiles mature.\",\n    },\n  },\n  {\n    re: /-----BEGIN (?:RSA )?PUBLIC KEY-----/g,\n    meta: {\n      id: \"pem-public-key\",\n      title: \"Classical public key (PEM)\",\n      description: \"SubjectPublicKeyInfo / PKCS#1 RSA public key block\",\n      category: \"certificate\",\n      severity: \"low\",\n      confidence: \"high\",\n      algorithm: \"unknown\",\n      hndl: false,\n      cwe: CWE_BROKEN_CRYPTO,\n      message:\n        \"Embedded classical public key (RSA/EC/DSA); its key pair is not quantum-safe — forgeable signatures or classical key exchange.\",\n      remediation: \"Re-issue with PQC keys (ML-DSA / ML-KEM) as the ecosystem adopts them.\",\n    },\n  },\n  {\n    re: /-----BEGIN DH PARAMETERS-----/g,\n    meta: {\n      id: \"pem-dh-parameters\",\n      title: \"Diffie-Hellman parameters (PEM)\",\n      description: \"Finite-field DH group parameters block\",\n      category: \"key-exchange\",\n      severity: \"medium\",\n      confidence: \"high\",\n      algorithm: \"DH\",\n      hndl: true,\n      cwe: CWE_BROKEN_CRYPTO,\n      message:\n        \"Embedded finite-field Diffie-Hellman parameters; classical DH key exchange is harvest-now-decrypt-later exposed.\",\n      remediation: \"Migrate key exchange to hybrid X25519MLKEM768 (ML-KEM-768).\",\n    },\n  },\n  {\n    re: /-----BEGIN (?:NEW )?CERTIFICATE REQUEST-----/g,\n    meta: {\n      id: \"pem-cert-request\",\n      title: \"Certificate signing request (PEM)\",\n      description: \"PKCS#10 certificate request block\",\n      category: \"certificate\",\n      severity: \"low\",\n      confidence: \"high\",\n      algorithm: \"unknown\",\n      hndl: false,\n      cwe: CWE_BROKEN_CRYPTO,\n      message:\n        \"Embedded PKCS#10 CSR; carries a classical public key and will be signed with classical crypto.\",\n      remediation: \"Re-generate with PQC keys as PQC-capable CAs mature.\",\n    },\n  },\n];\n\n/** Detects PEM key/certificate material in arbitrary files. */\nexport const pemDetector: Detector = {\n  id: \"pem-material\",\n  description: \"PEM-encoded private keys and X.509 certificates in any file\",\n  scope: \"config\",\n  language: \"any\",\n  rules: PEM_RULES.map((r) => r.meta),\n  // Applies to every text file; the walker already filters out binaries.\n  appliesTo: () => true,\n  detect({ file, content }): Finding[] {\n    // Fast reject: only proceed if a PEM header is present at all.\n    if (!content.includes(\"-----BEGIN \")) return [];\n\n    const findings: Finding[] = [];\n    for (const rule of PEM_RULES) {\n      eachMatch(rule.re, content, (m) => {\n        findings.push(\n          findingFromRule(rule.meta, {\n            file,\n            content,\n            index: m.index,\n            matchLength: m[0].length,\n          }),\n        );\n      });\n    }\n    return findings;\n  },\n};\n"]}
+{"version":3,"file":"pem.js","sourceRoot":"","sources":["../../src/detectors/pem.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAChE,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AASjE,MAAM,SAAS,GAAc;IAC3B;QACE,EAAE,EAAE,kCAAkC;QACtC,IAAI,EAAE;YACJ,EAAE,EAAE,qBAAqB;YACzB,KAAK,EAAE,uBAAuB;YAC9B,WAAW,EAAE,8BAA8B;YAC3C,QAAQ,EAAE,aAAa;YACvB,QAAQ,EAAE,UAAU;YACpB,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,KAAK;YAChB,IAAI,EAAE,IAAI;YACV,GAAG,EAAE,iBAAiB;YACtB,SAAS,EAAE,IAAI;YACf,OAAO,EAAE,wEAAwE;YACjF,WAAW,EAAE,+EAA+E;SAC7F;KACF;IACD;QACE,EAAE,EAAE,iCAAiC;QACrC,IAAI,EAAE;YACJ,EAAE,EAAE,oBAAoB;YACxB,KAAK,EAAE,sBAAsB;YAC7B,WAAW,EAAE,2BAA2B;YACxC,QAAQ,EAAE,aAAa;YACvB,QAAQ,EAAE,UAAU;YACpB,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,OAAO;YAClB,IAAI,EAAE,IAAI;YACV,GAAG,EAAE,iBAAiB;YACtB,SAAS,EAAE,IAAI;YACf,OAAO,EAAE,iFAAiF;YAC1F,WAAW,EACT,mIAAmI;SACtI;KACF;IACD;QACE,EAAE,EAAE,kCAAkC;QACtC,IAAI,EAAE;YACJ,EAAE,EAAE,qBAAqB;YACzB,KAAK,EAAE,uBAAuB;YAC9B,WAAW,EAAE,uBAAuB;YACpC,QAAQ,EAAE,aAAa;YACvB,QAAQ,EAAE,UAAU;YACpB,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,KAAK;YAChB,IAAI,EAAE,KAAK;YACX,GAAG,EAAE,iBAAiB;YACtB,SAAS,EAAE,IAAI;YACf,OAAO,EACL,sFAAsF;YACxF,WAAW,EAAE,6EAA6E;SAC3F;KACF;IACD;QACE,EAAE,EAAE,sCAAsC;QAC1C,IAAI,EAAE;YACJ,EAAE,EAAE,yBAAyB;YAC7B,KAAK,EAAE,qBAAqB;YAC5B,WAAW,EAAE,2BAA2B;YACxC,QAAQ,EAAE,aAAa;YACvB,QAAQ,EAAE,UAAU;YACpB,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,SAAS;YACpB,IAAI,EAAE,IAAI;YACV,GAAG,EAAE,iBAAiB;YACtB,SAAS,EAAE,IAAI;YACf,OAAO,EAAE,mFAAmF;YAC5F,WAAW,EACT,gIAAgI;SACnI;KACF;IACD;QACE,EAAE,EAAE,wCAAwC;QAC5C,IAAI,EAAE;YACJ,EAAE,EAAE,qBAAqB;YACzB,KAAK,EAAE,2BAA2B;YAClC,WAAW,EAAE,2BAA2B;YACxC,QAAQ,EAAE,aAAa;YACvB,QAAQ,EAAE,UAAU;YACpB,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,SAAS;YACpB,IAAI,EAAE,IAAI;YACV,GAAG,EAAE,iBAAiB;YACtB,SAAS,EAAE,IAAI;YACf,OAAO,EACL,+FAA+F;YACjG,WAAW,EAAE,yDAAyD;SACvE;KACF;IACD;QACE,EAAE,EAAE,8BAA8B;QAClC,IAAI,EAAE;YACJ,EAAE,EAAE,iBAAiB;YACrB,KAAK,EAAE,2BAA2B;YAClC,WAAW,EAAE,iCAAiC;YAC9C,QAAQ,EAAE,aAAa;YACvB,QAAQ,EAAE,KAAK;YACf,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,SAAS;YACpB,IAAI,EAAE,IAAI;YACV,GAAG,EAAE,iBAAiB;YACtB,OAAO,EACL,oGAAoG;YACtG,WAAW,EAAE,qEAAqE;SACnF;KACF;IACD;QACE,EAAE,EAAE,6CAA6C;QACjD,IAAI,EAAE;YACJ,EAAE,EAAE,uBAAuB;YAC3B,KAAK,EAAE,0BAA0B;YACjC,WAAW,EAAE,0BAA0B;YACvC,QAAQ,EAAE,aAAa;YACvB,QAAQ,EAAE,UAAU;YACpB,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,SAAS;YACpB,IAAI,EAAE,IAAI;YACV,GAAG,EAAE,iBAAiB;YACtB,SAAS,EAAE,IAAI;YACf,OAAO,EAAE,yEAAyE;YAClF,WAAW,EAAE,mEAAmE;SACjF;KACF;IACD;QACE,EAAE,EAAE,8BAA8B;QAClC,IAAI,EAAE;YACJ,EAAE,EAAE,iBAAiB;YACrB,KAAK,EAAE,yBAAyB;YAChC,WAAW,EAAE,yBAAyB;YACtC,QAAQ,EAAE,aAAa;YACvB,QAAQ,EAAE,KAAK;YACf,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,SAAS;YACpB,IAAI,EAAE,KAAK;YACX,GAAG,EAAE,iBAAiB;YACtB,OAAO,EAAE,+EAA+E;YACxF,WAAW,EAAE,8EAA8E;SAC5F;KACF;IACD;QACE,EAAE,EAAE,sCAAsC;QAC1C,IAAI,EAAE;YACJ,EAAE,EAAE,gBAAgB;YACpB,KAAK,EAAE,4BAA4B;YACnC,WAAW,EAAE,oDAAoD;YACjE,QAAQ,EAAE,aAAa;YACvB,QAAQ,EAAE,KAAK;YACf,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,SAAS;YACpB,IAAI,EAAE,KAAK;YACX,GAAG,EAAE,iBAAiB;YACtB,OAAO,EACL,gIAAgI;YAClI,WAAW,EAAE,wEAAwE;SACtF;KACF;IACD;QACE,EAAE,EAAE,gCAAgC;QACpC,IAAI,EAAE;YACJ,EAAE,EAAE,mBAAmB;YACvB,KAAK,EAAE,iCAAiC;YACxC,WAAW,EAAE,wCAAwC;YACrD,QAAQ,EAAE,cAAc;YACxB,QAAQ,EAAE,QAAQ;YAClB,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,IAAI;YACf,IAAI,EAAE,IAAI;YACV,GAAG,EAAE,iBAAiB;YACtB,OAAO,EACL,kHAAkH;YACpH,WAAW,EAAE,6DAA6D;SAC3E;KACF;IACD;QACE,EAAE,EAAE,+CAA+C;QACnD,IAAI,EAAE;YACJ,EAAE,EAAE,kBAAkB;YACtB,KAAK,EAAE,mCAAmC;YAC1C,WAAW,EAAE,mCAAmC;YAChD,QAAQ,EAAE,aAAa;YACvB,QAAQ,EAAE,KAAK;YACf,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,SAAS;YACpB,IAAI,EAAE,KAAK;YACX,GAAG,EAAE,iBAAiB;YACtB,OAAO,EACL,gGAAgG;YAClG,WAAW,EAAE,sDAAsD;SACpE;KACF;CACF,CAAC;AAEF;;;;;;;;;;;;;;;;GAgBG;AACH,SAAS,aAAa,CAAC,OAAe,EAAE,IAAY;IAClD,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,GAAG,GAAG,CAAC,CAAC;IAC/C,IAAI,yCAAyC,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IACxE,IAAI,uBAAuB,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IACtD,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,0BAA0B,CAAC,CAAC;IACtD,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AACzD,CAAC;AAED,+DAA+D;AAC/D,MAAM,CAAC,MAAM,WAAW,GAAa;IACnC,EAAE,EAAE,cAAc;IAClB,WAAW,EAAE,6DAA6D;IAC1E,KAAK,EAAE,QAAQ;IACf,QAAQ,EAAE,KAAK;IACf,KAAK,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACnC,uEAAuE;IACvE,SAAS,EAAE,GAAG,EAAE,CAAC,IAAI;IACrB,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE;QACtB,+DAA+D;QAC/D,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC;YAAE,OAAO,EAAE,CAAC;QAEhD,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;YAC7B,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;gBAChC,4DAA4D;gBAC5D,4EAA4E;gBAC5E,8EAA8E;gBAC9E,qDAAqD;gBACrD,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;oBAAE,OAAO;gBAC3D,QAAQ,CAAC,IAAI,CACX,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE;oBACzB,IAAI;oBACJ,OAAO;oBACP,KAAK,EAAE,CAAC,CAAC,KAAK;oBACd,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM;iBACzB,CAAC,CACH,CAAC;YACJ,CAAC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC","sourcesContent":["/**\n * Config / certificate detector: finds PEM-encoded cryptographic material in\n * any text file (source, config, .pem, .key, .crt, .env, …). This catches\n * embedded private keys and X.509 certificates regardless of language.\n *\n * Every rule's metadata lives in the {@link RuleMeta} declaration below (the\n * catalog entry); `detect()` builds findings straight from it via\n * `findingFromRule`. All PEM findings are high-confidence exact-marker matches.\n */\nimport type { Detector, Finding, RuleMeta } from \"../types.js\";\nimport { eachMatch, findingFromRule } from \"../detect-utils.js\";\nimport { CWE_BROKEN_CRYPTO, CWE_HARDCODED_KEY } from \"../cwe.js\";\n\n/** A PEM rule: its catalog metadata plus the begin-marker regex that triggers it. */\ninterface PemRule {\n  /** Regex matching the PEM begin marker. */\n  re: RegExp;\n  meta: RuleMeta;\n}\n\nconst PEM_RULES: PemRule[] = [\n  {\n    re: /-----BEGIN RSA PRIVATE KEY-----/g,\n    meta: {\n      id: \"pem-rsa-private-key\",\n      title: \"RSA private key (PEM)\",\n      description: \"PKCS#1 RSA private key block\",\n      category: \"certificate\",\n      severity: \"critical\",\n      confidence: \"high\",\n      algorithm: \"RSA\",\n      hndl: true,\n      cwe: CWE_HARDCODED_KEY,\n      sensitive: true,\n      message: \"Embedded RSA private key (PKCS#1 PEM); classical and not quantum-safe.\",\n      remediation: \"Migrate to ML-DSA / ML-KEM keys and remove embedded private keys from source.\",\n    },\n  },\n  {\n    re: /-----BEGIN EC PRIVATE KEY-----/g,\n    meta: {\n      id: \"pem-ec-private-key\",\n      title: \"EC private key (PEM)\",\n      description: \"SEC1 EC private key block\",\n      category: \"certificate\",\n      severity: \"critical\",\n      confidence: \"high\",\n      algorithm: \"ECDSA\",\n      hndl: true,\n      cwe: CWE_HARDCODED_KEY,\n      sensitive: true,\n      message: \"Embedded EC private key (SEC1 PEM); classical ECDSA/ECDH key, not quantum-safe.\",\n      remediation:\n        \"Migrate to ML-DSA (FIPS 204) for signatures or hybrid X25519MLKEM768 for key agreement; remove embedded private keys from source.\",\n    },\n  },\n  {\n    re: /-----BEGIN DSA PRIVATE KEY-----/g,\n    meta: {\n      id: \"pem-dsa-private-key\",\n      title: \"DSA private key (PEM)\",\n      description: \"DSA private key block\",\n      category: \"certificate\",\n      severity: \"critical\",\n      confidence: \"high\",\n      algorithm: \"DSA\",\n      hndl: false,\n      cwe: CWE_HARDCODED_KEY,\n      sensitive: true,\n      message:\n        \"Embedded DSA private key (PEM); classical, already deprecated, and not quantum-safe.\",\n      remediation: \"Rotate immediately (DSA is deprecated) and migrate to ML-DSA-65 (FIPS 204).\",\n    },\n  },\n  {\n    re: /-----BEGIN OPENSSH PRIVATE KEY-----/g,\n    meta: {\n      id: \"pem-openssh-private-key\",\n      title: \"OpenSSH private key\",\n      description: \"OpenSSH private key block\",\n      category: \"certificate\",\n      severity: \"critical\",\n      confidence: \"high\",\n      algorithm: \"unknown\",\n      hndl: true,\n      cwe: CWE_HARDCODED_KEY,\n      sensitive: true,\n      message: \"Embedded OpenSSH private key (RSA/ECDSA/Ed25519); classical and not quantum-safe.\",\n      remediation:\n        \"Rotate the key; plan migration to PQC-capable SSH (prefer the mlkem768x25519-sha256 KEX, OpenSSH 10's default since Apr 2025).\",\n    },\n  },\n  {\n    re: /-----BEGIN PGP PRIVATE KEY BLOCK-----/g,\n    meta: {\n      id: \"pem-pgp-private-key\",\n      title: \"PGP/GPG private key block\",\n      description: \"OpenPGP private key block\",\n      category: \"certificate\",\n      severity: \"critical\",\n      confidence: \"high\",\n      algorithm: \"unknown\",\n      hndl: true,\n      cwe: CWE_HARDCODED_KEY,\n      sensitive: true,\n      message:\n        \"Embedded PGP/GPG private key block (RSA/ECDSA/EdDSA/ElGamal); classical and not quantum-safe.\",\n      remediation: \"Rotate the key; track OpenPGP PQC drafts for migration.\",\n    },\n  },\n  {\n    re: /-----BEGIN PGP MESSAGE-----/g,\n    meta: {\n      id: \"pem-pgp-message\",\n      title: \"PGP/GPG encrypted message\",\n      description: \"OpenPGP encrypted message block\",\n      category: \"certificate\",\n      severity: \"low\",\n      confidence: \"high\",\n      algorithm: \"unknown\",\n      hndl: true,\n      cwe: CWE_BROKEN_CRYPTO,\n      message:\n        \"Embedded PGP/GPG message; likely encrypted with classical RSA/ElGamal (harvest-now-decrypt-later).\",\n      remediation: \"Re-encrypt with PQC-capable tooling as OpenPGP PQC profiles mature.\",\n    },\n  },\n  {\n    re: /-----BEGIN (?:ENCRYPTED )?PRIVATE KEY-----/g,\n    meta: {\n      id: \"pem-pkcs8-private-key\",\n      title: \"Private key (PKCS#8 PEM)\",\n      description: \"PKCS#8 private key block\",\n      category: \"certificate\",\n      severity: \"critical\",\n      confidence: \"high\",\n      algorithm: \"unknown\",\n      hndl: true,\n      cwe: CWE_HARDCODED_KEY,\n      sensitive: true,\n      message: \"Embedded PKCS#8 private key; likely classical RSA/EC, not quantum-safe.\",\n      remediation: \"Migrate to PQC keys and remove embedded private keys from source.\",\n    },\n  },\n  {\n    re: /-----BEGIN CERTIFICATE-----/g,\n    meta: {\n      id: \"pem-certificate\",\n      title: \"X.509 certificate (PEM)\",\n      description: \"X.509 certificate block\",\n      category: \"certificate\",\n      severity: \"low\",\n      confidence: \"high\",\n      algorithm: \"unknown\",\n      hndl: false,\n      cwe: CWE_BROKEN_CRYPTO,\n      message: \"Embedded X.509 certificate; almost certainly signed with classical RSA/ECDSA.\",\n      remediation: \"Plan re-issuance with PQC-capable CAs as ML-DSA certificate profiles mature.\",\n    },\n  },\n  {\n    re: /-----BEGIN (?:RSA )?PUBLIC KEY-----/g,\n    meta: {\n      id: \"pem-public-key\",\n      title: \"Classical public key (PEM)\",\n      description: \"SubjectPublicKeyInfo / PKCS#1 RSA public key block\",\n      category: \"certificate\",\n      severity: \"low\",\n      confidence: \"high\",\n      algorithm: \"unknown\",\n      hndl: false,\n      cwe: CWE_BROKEN_CRYPTO,\n      message:\n        \"Embedded classical public key (RSA/EC/DSA); its key pair is not quantum-safe — forgeable signatures or classical key exchange.\",\n      remediation: \"Re-issue with PQC keys (ML-DSA / ML-KEM) as the ecosystem adopts them.\",\n    },\n  },\n  {\n    re: /-----BEGIN DH PARAMETERS-----/g,\n    meta: {\n      id: \"pem-dh-parameters\",\n      title: \"Diffie-Hellman parameters (PEM)\",\n      description: \"Finite-field DH group parameters block\",\n      category: \"key-exchange\",\n      severity: \"medium\",\n      confidence: \"high\",\n      algorithm: \"DH\",\n      hndl: true,\n      cwe: CWE_BROKEN_CRYPTO,\n      message:\n        \"Embedded finite-field Diffie-Hellman parameters; classical DH key exchange is harvest-now-decrypt-later exposed.\",\n      remediation: \"Migrate key exchange to hybrid X25519MLKEM768 (ML-KEM-768).\",\n    },\n  },\n  {\n    re: /-----BEGIN (?:NEW )?CERTIFICATE REQUEST-----/g,\n    meta: {\n      id: \"pem-cert-request\",\n      title: \"Certificate signing request (PEM)\",\n      description: \"PKCS#10 certificate request block\",\n      category: \"certificate\",\n      severity: \"low\",\n      confidence: \"high\",\n      algorithm: \"unknown\",\n      hndl: false,\n      cwe: CWE_BROKEN_CRYPTO,\n      message:\n        \"Embedded PKCS#10 CSR; carries a classical public key and will be signed with classical crypto.\",\n      remediation: \"Re-generate with PQC keys as PQC-capable CAs mature.\",\n    },\n  },\n];\n\n/**\n * True when what follows the begin marker looks like a REAL PEM block rather than a\n * `-----BEGIN …-----` header STRING LITERAL (as appears in PEM parsers, tests, and\n * i18n messages). `from` points just past the begin marker. Three accepting signals:\n *\n *  (a) a full LINE of base64 (≥24 chars, optional `=` padding) — real multi-line PEM\n *      bodies are line-wrapped base64; requiring the whole line to be base64 stops a\n *      long camelCase identifier on a code line from validating a bare header constant.\n *  (b) an ESCAPED-newline base64 run (`\\n<base64>`, a LITERAL backslash-n) — a key\n *      embedded in a single-line JSON/.env string (GCP service accounts, `PRIVATE_KEY=\n *      \"…\\n…\"`), whose body can run past the window before its `-----END`. The literal\n *      `\\n` escape distinguishes it from a source constant, which has a REAL newline.\n *  (c) a matching `-----END …-----` marker with NO double-quote between it and the\n *      begin marker. This admits short/placeholder bodies (`x`, `abc`, `MIIB` in tests)\n *      while rejecting a parser's PAIRED header/footer constants, whose intervening\n *      `\";` … `= \"` always contains a `\"` — a char a real PEM body never holds.\n */\nfunction hasBase64Body(content: string, from: number): boolean {\n  const window = content.slice(from, from + 800);\n  if (/^[ \\t]*[A-Za-z0-9+/]{24,}={0,2}[ \\t]*$/m.test(window)) return true;\n  if (/\\\\n[A-Za-z0-9+/]{24,}/.test(window)) return true;\n  const end = window.search(/-----END [A-Z0-9 ]+-----/);\n  return end >= 0 && !window.slice(0, end).includes('\"');\n}\n\n/** Detects PEM key/certificate material in arbitrary files. */\nexport const pemDetector: Detector = {\n  id: \"pem-material\",\n  description: \"PEM-encoded private keys and X.509 certificates in any file\",\n  scope: \"config\",\n  language: \"any\",\n  rules: PEM_RULES.map((r) => r.meta),\n  // Applies to every text file; the walker already filters out binaries.\n  appliesTo: () => true,\n  detect({ file, content }): Finding[] {\n    // Fast reject: only proceed if a PEM header is present at all.\n    if (!content.includes(\"-----BEGIN \")) return [];\n\n    const findings: Finding[] = [];\n    for (const rule of PEM_RULES) {\n      eachMatch(rule.re, content, (m) => {\n        // Require an actual base64 body after the marker, so a bare\n        // `-----BEGIN RSA PRIVATE KEY-----` string literal in a PEM parser / test /\n        // i18n message does NOT get reported as an embedded key. A real PEM block has\n        // a run of base64 within the next few hundred chars.\n        if (!hasBase64Body(content, m.index + m[0].length)) return;\n        findings.push(\n          findingFromRule(rule.meta, {\n            file,\n            content,\n            index: m.index,\n            matchLength: m[0].length,\n          }),\n        );\n      });\n    }\n    return findings;\n  },\n};\n"]}

package/dist/detectors/php.d.ts

@@ -5,7 +5,8 @@
  *
  *  - **ext/openssl** — `openssl_pkey_new()` (classified by its
  *    `OPENSSL_KEYTYPE_*` config, defaulting to RSA), `openssl_public_encrypt` /
- *    `openssl_private_decrypt` (RSA), and `openssl_sign` / `openssl_verify`.
+ *    `openssl_private_decrypt` / `openssl_seal` / `openssl_open` (RSA), and
+ *    `openssl_sign` / `openssl_verify`.
  *  - **phpseclib3** — `RSA::createKey()` / `EC::createKey()` / `DSA::createKey()`.
  *  - **libsodium** — `sodium_crypto_box`/`kx` keypairs (X25519) and
  *    `sodium_crypto_sign` keypairs (Ed25519).

package/dist/detectors/php.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"php.d.ts","sourceRoot":"","sources":["../../src/detectors/php.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAqB,MAAM,aAAa,CAAC;AAqI/D,kFAAkF;AAClF,eAAO,MAAM,WAAW,EAAE,QAsEzB,CAAC"}
+{"version":3,"file":"php.d.ts","sourceRoot":"","sources":["../../src/detectors/php.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAqB,MAAM,aAAa,CAAC;AAyI/D,kFAAkF;AAClF,eAAO,MAAM,WAAW,EAAE,QAsEzB,CAAC"}